Retard

**Name of the Vulnerable Software and Affected Versions** daverave Link Bank (affected versions not specified) **Description** A direct static code injection issue exists due to the lack of sanitization of the `url name` parameter in the `add link.txt` file. This allows remote attackers to execute arbitrary PHP code, which is later stored in `links.txt` and used in an include statement. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** phpArcadeScript versions 2.0 and earlier **Description** The issue allows remote attackers to inject arbitrary web script or HTML via several parameters, including `gamename` in "tellafriend.php", `login status` in "loginbox.php", `submissionstatus` in "index.php", `cell title background color` and `browse cat name` in "browse.php", and `gamefile` in "displaygame.php". This could potentially affect a large number of devices worldwide, although the exact number is not specified. There is no information provided about real-world incidents where this issue was exploited. **Recommendations** For phpArcadeScript versions 2.0 and earlier, consider disabling the affected parameters, such as `gamename`, `login status`, `submissionstatus`, `cell title background color`, `browse cat name`, and `gamefile`, until a patch is available. Restrict access to the vulnerable PHP scripts, including "tellafriend.php", "loginbox.php", "index.php", "browse.php", and "displaygame.php", to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Simplog versions 1.0.2 and earlier **Description** A directory traversal issue exists, allowing remote attackers to include or read arbitrary .txt files. This is achieved via the `act` and `blogid` parameters in the index.php file. **Recommendations** For Simplog versions 1.0.2 and earlier, as a temporary workaround, consider restricting access to the index.php file until a patch is available. Avoid using the `act` and `blogid` parameters in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.