Number 7

**Name of the Vulnerable Software and Affected Versions** Purei CMS version 1.0 **Description** Purei CMS version 1.0 contains a time-based blind SQL injection vulnerability. Attackers can manipulate database queries through unfiltered user input parameters. The vulnerability can be exploited through endpoints such as `getAllParks.php` and `events-ajax.php` by injecting crafted SQL payloads to potentially extract or modify database information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** asaanCart version 0.9 **Description** The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through various means, including the PATH INFO to specific PHP files such as `calc.php`, `chat.php`, `register.php`, or `index.php` in the `libs/smarty ajax/` directory, or by manipulating the `page` parameter in `libs/smarty ajax/index.php`. **Recommendations** For asaanCart version 0.9, consider disabling access to the `calc.php`, `chat.php`, `register.php`, and `index.php` files in the `libs/smarty ajax/` directory, as well as restricting the `page` parameter in `libs/smarty ajax/index.php` to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** asaanCart version 0.9 **Description** A directory traversal issue allows remote attackers to include arbitrary local files by using a .. (dot dot) in the `page` parameter to "index.php". **Recommendations** For asaanCart version 0.9, consider restricting access to the `page` parameter in the "index.php" file until a patch is available. As a temporary workaround, avoid using the `page` parameter with untrusted input to minimize the risk of exploitation.