Stux

**Name of the Vulnerable Software and Affected Versions** vTiger CRM version 6.4.0 **Description** A problematic issue has been identified, affecting the /modules/Mobile/index.php file. The manipulation of the ` operation` argument leads to cross-site scripting. This issue can be exploited remotely. **Recommendations** For version 6.4.0, as a temporary workaround, consider restricting access to the `/modules/Mobile/index.php` file until a patch is available. Avoid manipulating the ` operation` argument in the affected file to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: SIAM Industria de Automação e Monitoramento SIAM version 2.0 Description: A problematic issue has been found in SIAM Industria de Automação e Monitoramento, affecting some unknown processing of the file /qrcode.jsp. The manipulation of the `url` argument leads to Cross Site Scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Recommendations: For SIAM Industria de Automação e Monitoramento SIAM version 2.0, as a temporary workaround, consider restricting access to the /qrcode.jsp file until a patch is available. Avoid using the `url` argument in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: Pix Software Vivaz version 6.0.10 Description: A problematic vulnerability was found in Pix Software Vivaz, affecting unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Recommendations: For Pix Software Vivaz version 6.0.10, as a temporary workaround, consider restricting access to sensitive operations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Allims lab.online versions up to 20250201 Description: A critical issue was found in the processing of the file /model/model recuperar senha.php, where the manipulation of the `recuperacao` argument leads to SQL injection. This issue can be exploited remotely. The vendor was contacted about the disclosure but did not respond. Recommendations: For versions up to 20250201, as a temporary workaround, consider restricting access to the `/model/model recuperar senha.php` file until a patch is available. Avoid using the `recuperacao` argument in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Pix Software Vivaz version 6.0.10 Description: A critical issue has been found in the code related to the `/servlet?act=login` file, where manipulation of the `usuario` argument can lead to SQL injection. This issue can be exploited remotely. The vendor was contacted about the disclosure but did not respond. Recommendations: For Pix Software Vivaz version 6.0.10, consider disabling the `/servlet?act=login` endpoint or restricting access to it until a patch is available. Additionally, avoid using the `usuario` argument in the affected endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Mobotix M15 version 4.3.4.83 **Description** A vulnerability was found in the processing of the file "/control/player?center&eventlist&pda&dummy for reload=1736177631&p evt". The manipulation of the argument `p qual` leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. **Recommendations** For Mobotix M15 version 4.3.4.83, as a temporary workaround, consider restricting access to the "/control/player" endpoint until a patch is available. Avoid using the argument `p qual` in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Virtual Computer Vysual RH Solution version 2024.12.1 **Description** A problematic issue was found in the Login Panel component, specifically in the /index.php file, affecting an unknown functionality. The manipulation of the `page` argument leads to cross-site scripting. This issue can be exploited remotely. The exploit has been publicly disclosed, and the vendor was contacted but did not respond. **Recommendations** For Virtual Computer Vysual RH Solution version 2024.12.1, as a temporary workaround, consider restricting access to the `/index.php` file of the Login Panel component to minimize the risk of exploitation. Avoid using the `page` argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Intelbras InControl versions up to 2.21.57 **Description** A critical issue affects some unknown functionality of the file /v1/operador/ of the component Relatório de Operadores Page. The manipulation of the `fields` argument leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For Intelbras InControl versions up to 2.21.57, upgrade to version 2.21.58 to address this issue. As a temporary workaround, consider restricting access to the /v1/operador/ endpoint of the Relatório de Operadores Page until the patch is applied.

Name of the Vulnerable Software and Affected Versions: Grocy versions up to 4.2.0 Description: A problematic vulnerability was found in the SVG File Upload Handler component of Grocy, affecting the `/api/files/recipepictures/` path. The manipulation of the `force serve as` argument with the input `picture` leads to cross-site scripting. The attack can be initiated remotely. The real existence of this vulnerability is still doubted, and the project maintainer does not want to be quoted regarding the dispute rationale. The security policy of the project implies that this finding is "practically irrelevant" due to authentication requirements. Some increased actor activities are shown targeting Grocy. Recommendations: To safeguard your system, ensure you update to the latest version and apply all recommended patches. As a temporary workaround, consider restricting access to the `/api/files/recipepictures/` path in the SVG File Upload Handler component until a patch is available. Avoid using the `force serve as` argument with the input `picture` in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Scada-LTS version 2.7.8 **Description** A vulnerability has been found in the Message Handler component of Scada-LTS, related to the file /Scada-LTS/app.shtm#/alarms/Scada. The manipulation leads to cross-site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This issue is associated with the lack of protection measures for the web page structure, which may allow an attacker to conduct cross-site scripting attacks. **Recommendations** For Scada-LTS version 2.7.8, a fix is planned for the upcoming release at the end of September 2024. As a temporary workaround, consider restricting access to the vulnerable Message Handler component to minimize the risk of exploitation. Avoid using the affected file /Scada-LTS/app.shtm#/alarms/Scada until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** ZKTeco ZKBio CVSecurity V5000 version 4.1.0 **Description** A problematic issue was found in the Push Configuration Section component. The manipulation of the `Configuration Name` argument leads to cross-site scripting. It is possible to initiate the attack remotely. The vendor was contacted about this disclosure but did not respond. **Recommendations** For ZKTeco ZKBio CVSecurity V5000 version 4.1.0, as a temporary workaround, consider restricting access to the Push Configuration Section until a patch is available. Avoid manipulating the `Configuration Name` argument in this section to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: Intelbras InControl version 2.21.56 Description: A critical vulnerability was found in Intelbras InControl, affecting unknown code of the component incontrolWebcam Service. The manipulation leads to an unquoted search path, requiring local access to approach this attack. The exploit has been disclosed to the public and may be used. Recommendations: For Intelbras InControl version 2.21.56, upgrade to version 2.21.58 to address this issue. It is recommended to upgrade the affected component as soon as possible.

Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio CVSecurity V5000 version 4.1.0 Description: A vulnerability was found in the Department Section component, where the manipulation of the `Department Name` argument leads to cross-site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Recommendations: For ZKTeco ZKBio CVSecurity V5000 version 4.1.0, consider disabling the Department Section component or restricting access to it until a patch is available. Avoid using the `Department Name` argument in the affected component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio CVSecurity V5000 version 4.1.0 Description: A vulnerability was found in the component Summer Schedule Handler. The manipulation of the `Schedule Name` argument leads to cross-site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Recommendations: For version 4.1.0, as a temporary workaround, consider restricting the use of the `Schedule Name` argument in the Summer Schedule Handler component until a patch is available. Avoid using the `Schedule Name` argument in the affected functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** app1pro Shopicial versions up to 20230830 **Description** A problem has been found in the file search code, allowing for cross-site scripting through the manipulation of the `with` argument and input like `comments</script>'"><img src=x onerror=alert(document.cookie)>`. This issue can be exploited remotely. **Recommendations** For app1pro Shopicial versions up to 20230830, consider restricting the use of the file search function until a fix is available. As a temporary workaround, avoid using the `with` argument in the affected file search functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gira HomeServer versions up to 4.12.0.220829 beta **Description** A problematic issue was found, affecting unknown code of the file /hslist. The manipulation of the argument `lst` with the input `debug%27"><img%20src=x%20onerror=alert(document.cookie)>` leads to cross-site scripting. The attack can be initiated remotely. **Recommendations** For Gira HomeServer versions up to 4.12.0.220829 beta, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the `/hslist` file to minimize the risk of exploitation. Avoid using the `lst` argument in the affected file until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Control iD RHiD version 23.3.19.0 **Description** A critical vulnerability has been found in Control iD RHiD, affecting an unknown part of the file /v2/#/. The manipulation leads to direct request and can be initiated remotely. The vendor was contacted about this disclosure but did not respond. **Recommendations** For version 23.3.19.0, as a temporary workaround, consider restricting access to the affected file /v2/#/ until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Control iD RHiD version 23.3.19.0 **Description** A problematic issue has been discovered, affecting an unknown function of the file /v2/#/add/department. The manipulation of the `Name` argument leads to cross-site scripting. This issue can be exploited remotely. The vendor was contacted about this disclosure but did not respond. **Recommendations** For version 23.3.19.0, as a temporary workaround, consider restricting access to the /v2/#/add/department endpoint until a patch is available. Avoid using the `Name` argument in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Control iD RHiD version 23.3.19.0 **Description** A problematic vulnerability was found in the Edit Handler component, affecting an unknown part of the file /v2/customerdb/operator.svc/a. The manipulation of the `email` argument leads to SQL injection, and it is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond. **Recommendations** For version 23.3.19.0, as a temporary workaround, consider restricting access to the `/v2/customerdb/operator.svc/a` endpoint until a patch is available. Additionally, avoid using the `email` argument in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Control iD iDSecure version 4.7.29.1 **Description** A vulnerability has been found in the component Dispositivos Page, where the manipulation of the `IP-DNS` argument leads to cross-site scripting. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. **Recommendations** For version 4.7.29.1, consider restricting access to the Dispositivos Page component to minimize the risk of exploitation. As a temporary workaround, avoid using the `IP-DNS` argument in the affected component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.