R0T

**Name of the Vulnerable Software and Affected Versions** NetArtMEDIA WebSiteAdmin (affected versions not specified) **Description** The issue allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the `lng` parameter of the ADMIN/login.php file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NetArt MEDIA Real Estate Portal version 2.0 **Description** The issue concerns a cross-site scripting (XSS) vulnerability. This vulnerability allows remote authenticated users to inject arbitrary web script or HTML via the `id` parameter in the AGENTS/index.php file. **Recommendations** For version 2.0, avoid using the `id` parameter in the AGENTS/index.php file until the issue is resolved. As a temporary workaround, consider restricting access to the AGENTS/index.php file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** NetArt MEDIA Real Estate Portal version 2.0 **Description** The issue concerns directory traversal vulnerabilities in the AGENTS/index.php file. Remote attackers can exploit this to include and execute arbitrary local files by using directory traversal sequences in the `folder` and `action` parameters. **Recommendations** For NetArt MEDIA Real Estate Portal version 2.0, restrict access to the `folder` and `action` parameters in the AGENTS/index.php file to minimize the risk of exploitation. Avoid using directory traversal sequences in these parameters until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** XSE Shopping Cart versions 1.5.2.1 through 1.5.3.0 **Description** The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the `id` parameter to "Default.aspx" or the `type` parameter to "SearchResults.aspx". **Recommendations** For version 1.5.2.1, avoid using the `id` parameter in the "Default.aspx" endpoint and the `type` parameter in the "SearchResults.aspx" endpoint until a fix is available. For version 1.5.3.0, avoid using the `id` parameter in the "Default.aspx" endpoint and the `type` parameter in the "SearchResults.aspx" endpoint until a fix is available.

**Name of the Vulnerable Software and Affected Versions** iBoutique.MALL version 1.2 **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the `tmpl` parameter in the hosted signup module's index.php file. **Recommendations** For version 1.2, as a temporary workaround, consider restricting access to the hosted signup module until a patch is available. Avoid using the `tmpl` parameter in the affected index.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** PowerStore version 3.0 **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `totalRows WADAProducts` parameter in the Products Results.php file. **Recommendations** For PowerStore version 3.0, update the Products Results.php file to properly sanitize the `totalRows WADAProducts` parameter to prevent XSS attacks. As a temporary workaround, consider restricting access to the Products Results.php file until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Open Classifieds version 1.7.0.2 **Description** The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters, including `desc`, `price`, `title`, and `place` parameters to "index.php" and the `subject` parameter to "contact.htm", which is related to "content/contact.php". **Recommendations** For Open Classifieds version 1.7.0.2, as a temporary workaround, consider restricting user input for the `desc`, `price`, `title`, `place`, and `subject` parameters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DirectAdmin versions 1.33.6 and earlier **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the URI in a view=advanced request. This occurs due to a vulnerability in CMD REDIRECT. **Recommendations** For versions 1.33.6 and earlier, update to a version later than 1.33.6 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: activeCollab version 2.1 Corporate Description: The issue allows remote attackers to obtain sensitive information. This is achieved by providing an invalid `re route` parameter to the "login script", which in turn reveals the installation path in an error message. Recommendations: For activeCollab version 2.1 Corporate, consider restricting access to the login script until a fix is available, or avoid using the `re route` parameter in the login script to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: activeCollab version 2.1 Corporate Description: The issue allows remote attackers to inject arbitrary web script or HTML via the `re route` parameter to the login script, enabling cross-site scripting (XSS) attacks. Recommendations: For activeCollab version 2.1 Corporate, as a temporary workaround, consider restricting access to the login script until a patch is available. Avoid using the `re route` parameter in the affected login script until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Wikepage Opus version 13 2007.2 TipiWiki version 2 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the `PageContent` and `PageName` parameters in the index.php file. Recommendations: For Wikepage Opus version 13 2007.2, avoid using the `PageContent` and `PageName` parameters in the index.php file until the issue is resolved. For TipiWiki version 2, restrict access to the index.php file to minimize the risk of exploitation, specifically by limiting input for the `PageContent` and `PageName` parameters.

Name of the Vulnerable Software and Affected Versions: Directory Image Gallery version 1.1 Description: A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `backwardDirectory` parameter in the photos.cfm file. Recommendations: For Directory Image Gallery version 1.1, consider restricting access to the photos.cfm file until a patch is available, and avoid using the `backwardDirectory` parameter in this file to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Helm version 3.2.16 Description: The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The affected parameters include the `showOption` parameter to the "domain.asp" endpoint, and the `Folder` or `StartPath` parameters to the "FileManager.asp" endpoint. Recommendations: For Helm version 3.2.16, consider disabling access to the "domain.asp" and "FileManager.asp" endpoints until a patch is available. As a temporary workaround, restrict the use of the `showOption`, `Folder`, and `StartPath` parameters to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OdysseySuite version 4.0.729 **Description** The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the `idkey` parameter. **Recommendations** For version 4.0.729, avoid using the `idkey` parameter in the affected Mailbox.mws until the issue is resolved. As a temporary workaround, consider restricting access to the Mailbox.mws module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenRat CMS versions 0.8-beta1 and earlier **Description** The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the `subaction` and `action` parameters in the index.php file. **Recommendations** For OpenRat CMS versions 0.8-beta1 and earlier, as a temporary workaround, consider restricting access to the index.php file until a patch is available. Avoid using the `subaction` and `action` parameters in the index.php file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WebDirector versions 2.2 and earlier **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `deslocal` parameter in the "index.php" file. **Recommendations** For WebDirector versions 2.2 and earlier, as a temporary workaround, consider restricting access to the `deslocal` parameter in the "index.php" file until a patch is available.

**Name of the Vulnerable Software and Affected Versions** OpenRat CMS versions 0.8-beta1 and earlier **Description** The issue allows remote attackers to obtain sensitive information by sending a request with an XSS sequence in the `action` parameter to "index.php", which reveals the path in an error message. **Recommendations** For OpenRat CMS versions 0.8-beta1 and earlier, avoid using the `action` parameter in the "index.php" endpoint until the issue is resolved. As a temporary workaround, consider restricting access to the "index.php" endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Brain Book Software Secure versions 1.0.20070629 and earlier Description: The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the `user` and `pwd` parameters in the "login.php" file. Recommendations: For Brain Book Software Secure versions 1.0.20070629 and earlier, as a temporary workaround, consider restricting access to the "login.php" file until a patch is available. Avoid using the `user` and `pwd` parameters in the affected login functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** rwAuction Pro version 5.0 **Description** The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters in the search.asp file. The vulnerable parameters include `search`, `show`, `searchtype`, `catid`, and `searchtxt`. **Recommendations** For rwAuction Pro version 5.0, ensure proper input validation and sanitization for the `search`, `show`, `searchtype`, `catid`, and `searchtxt` parameters in the search.asp file to prevent XSS attacks. As a temporary workaround, consider restricting access to the search.asp file until a patch is available.

**Name of the Vulnerable Software and Affected Versions** QuickTalk guestbook version 1.2 **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `id` parameter in the qtg msg view.php file. **Recommendations** For QuickTalk guestbook version 1.2, consider restricting access to the qtg msg view.php file until a patch is available, and avoid using the `id` parameter in this file to minimize the risk of exploitation.