Novysodopeo

**Name of the Vulnerable Software and Affected Versions** Hexo versions up to 7.0.0 (RC2) **Description** Hexo was discovered to contain an arbitrary file read issue. This allows for the reading of arbitrary files, potentially leading to sensitive information disclosure. **Recommendations** For versions up to 7.0.0 (RC2), update to a version later than 7.0.0 (RC2) to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LuckyframeWEB version 3.5 **Description** A SQL injection issue was found in LuckyframeWEB via the `dataScope` parameter at the "/system/UserMapper.xml" API endpoint. This allows for potential exploitation. **Recommendations** For LuckyframeWEB version 3.5, consider restricting access to the `/system/UserMapper.xml` API endpoint until a patch is available. As a temporary workaround, avoid using the `dataScope` parameter in this endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** LuckyframeWEB version 3.5 **Description** A SQL injection issue was found in LuckyframeWEB via the `dataScope` parameter at the "/system/RoleMapper.xml" API endpoint. This allows for potential exploitation. **Recommendations** For LuckyframeWEB version 3.5, consider restricting access to the `/system/RoleMapper.xml` API endpoint until a patch is available. As a temporary workaround, avoid using the `dataScope` parameter in this endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** LuckyframeWEB version 3.5 **Description** A SQL injection issue was found in LuckyframeWEB via the `dataScope` parameter at the "/system/DeptMapper.xml" API endpoint. This allows for potential SQL injection attacks. **Recommendations** For LuckyframeWEB version 3.5, consider restricting access to the `/system/DeptMapper.xml` API endpoint until a patch is available. As a temporary workaround, avoid using the `dataScope` parameter in this endpoint to minimize the risk of exploitation.