Nkingpp

**Name of the Vulnerable Software and Affected Versions** mccms version 2.6 **Description** The issue allows remote attackers to run arbitrary SQL commands via the Author Center ->Reader Comments ->Search function. This can be exploited by accessing the `Author Center` and then navigating to `Reader Comments` and `Search`. The specific API endpoint involved is not clearly specified, but the vulnerability is related to SQL injection, which typically involves manipulating user input to execute unauthorized SQL code. **Recommendations** For mccms version 2.6, consider restricting access to the `Author Center ->Reader Comments ->Search` function until a patch is available. As a temporary workaround, avoid using the search functionality in the Reader Comments section to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** mccms version 2.6.1 **Description** An issue in the Backend management interface, specifically in System Configuration->Cache Configuration->Cache security characters, allows remote attackers to cause a denial of service. **Recommendations** For mccms version 2.6.1, consider restricting access to the Backend management interface, specifically to the System Configuration->Cache Configuration->Cache security characters section, until a fix is available.

**Name of the Vulnerable Software and Affected Versions** ZKEACMS version 3.5.2 **Description** A cross-site scripting (XSS) issue exists in the `/navigation/create?ParentID=%23` endpoint of ZKEACMS, allowing attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `ParentID` parameter. **Recommendations** For ZKEACMS version 3.5.2, consider disabling access to the `/navigation/create?ParentID=%23` endpoint until a patch is available. As a temporary workaround, restrict the use of the `ParentID` parameter in this endpoint to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: WDScanner version 1.1 Description: A Cross Site Scripting issue exists in the system management page, which may allow for malicious script execution. Recommendations: For WDScanner version 1.1, update to a newer version that contains a fix for this issue, if available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.