Raed

Name of the Vulnerable Software and Affected Versions: Z-Blog version 1.7 Description: The issue allows remote attackers to download the database via a direct request for `zblog.mdb` due to insufficient access control. This is because sensitive information is stored under the web root. Recommendations: For Z-Blog version 1.7, consider restricting access to the `zblog.mdb` file to prevent unauthorized downloads until a proper fix is applied. As a temporary workaround, moving sensitive files outside of the web root or implementing proper access controls can help mitigate the risk.

Multiple PHP remote file inclusion vulnerabilities in Download-Engine 1.4.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) eng dir parameter to addmember.php, (2) lang path parameter to admin/enginelib/class.phpmailer.php, and the (3) spaw root parameter to admin/includes/spaw/dialogs/colorpicker.php, different vectors than CVE-2006-5291 and CVE-2006-5459. NOTE: vector 3 might be an issue in SPAW.

**Name of the Vulnerable Software and Affected Versions** SLAED CMS 2 **Description** The issue allows remote attackers to execute arbitrary PHP code via a URL in the `path` parameter to "admin/admin.php" or the `modpath` parameter to "index.php". This can be exploited by providing a malicious URL as the value for these parameters, potentially leading to the execution of unauthorized PHP code. **Recommendations** For SLAED CMS 2, as a temporary workaround, consider restricting access to the "admin/admin.php" and "index.php" scripts until a patch is available. Avoid using the `path` and `modpath` parameters in these scripts until the issue is resolved.