Sajibe Kanti

**Name of the Vulnerable Software and Affected Versions** ERPGo SaaS version 3.9 **Description** An issue exists where authenticated attackers can execute arbitrary code by injecting formula payloads into vendor name fields. This occurs when malicious formulas are entered into the vendor creation form and subsequently executed when the exported CSV file is opened in spreadsheet applications. **Recommendations** As a temporary workaround, restrict the use of the vendor creation form or sanitize inputs in the vendor name field to prevent the use of formula characters until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AmazCart CMS version 3.4 **Description** A reflected cross-site scripting issue allows unauthenticated attackers to inject malicious scripts via the search functionality. By entering script tags in the search box, attackers can execute arbitrary JavaScript when search results are displayed or search history is viewed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netis WF2419 version 3.2.41381 **Description** The issue allows for XSS via the Description field on the MAC Filtering page. **Recommendations** For Netis WF2419 version 3.2.41381, consider restricting access to the MAC Filtering page until a fix is available. As a temporary workaround, avoid using the Description field on the MAC Filtering page to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Mahara versions 15.04 through 15.04.9 Mahara versions 15.10 through 15.10.5 Mahara versions 16.04 through 16.04.3 **Description** The issue arises from incorrect access control after a password reset link is sent via email and the user changes their default email. Mahara fails to invalidate the old link, allowing the link in the email to be used to gain access to the user's account. **Recommendations** For Mahara versions 15.04 through 15.04.9, update to version 15.04.10 or later. For Mahara versions 15.10 through 15.10.5, update to version 15.10.6 or later. For Mahara versions 16.04 through 16.04.3, update to version 16.04.4 or later.