Slimtim10

Name of the Vulnerable Software and Affected Versions: MGB OpenSource Guestbook versions 0.5.4.5 and earlier Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `id` parameter in the email.php file. Recommendations: For MGB OpenSource Guestbook versions 0.5.4.5 and earlier, avoid using the `id` parameter in the email.php file until the issue is resolved. As a temporary workaround, consider restricting access to the email.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Laurent Van den Reysen WORK system e-commerce versions 3.0.2 through 3.0.3 **Description** The issue allows remote attackers to execute arbitrary PHP code via a URL in the `g include` parameter to various files, including (1) "index.php", (2) "module/forum/forum.php", (3) unspecified files under "module/", and (4) unspecified files under "administration/module/". **Recommendations** For versions 3.0.2 through 3.0.3, update to version 3.0.4 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Creasito E-Commerce Content Manager version 1.3.08 Description: The issue allows remote attackers to bypass authentication and perform privileged functions. This can be achieved by providing a non-empty `finame` parameter to various API endpoints, including "addnewcont.php", "adminpassw.php", "amministrazione.php", "artins.php", "bgcolor.php", "cancartcat.php", "canccat.php", "cancelart.php", "cancontsit.php", "chanpassamm.php", "dele.php", "delecat.php", "delecont.php", "emailall.php", "gestflashtempl.php", "gestmagart.php", "gestmagaz.php", "gestpre.php", "input.php", "input3.php", "insnucat.php", "instempflash.php", "mailfc.php", "modfdati.php", "rescont4.php", "ricordo1.php", "ricordo4.php", "tabcatalg.php", "tabcont.php", "tabcont3.php", "tabstile.php", "tabstile3.php", "testimmg.php", and "update.php" in the "admin/" directory. Recommendations: For Creasito E-Commerce Content Manager version 1.3.08, consider disabling access to the listed API endpoints in the "admin/" directory until a patch is available. Restrict the use of the `finame` parameter in these endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.