Paramecium

**Name of the Vulnerable Software and Affected Versions** chiuwingyan house versions up to dea6bcceaebe2b364a5a209747f48ecc2b2dc670 **Description** A remote SQL injection exists in the `/paid/selectall.action` endpoint. This occurs when the `zuname` argument is manipulated, allowing an attacker to execute arbitrary SQL commands on the database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** yeqifu warehouse versions up to aaf29962ba407d22d991781de28796ee7b4670e4 **Description** A path traversal issue exists due to improper processing of the `path` argument within the `src/main/java/com/yeqifu/sys/controller/FileController.java` file. This flaw allows a remote attacker to manipulate file paths to access unauthorized directories or files. Path traversal is a technique used to access files and directories that are stored outside the web root folder. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.