Summmm

**Name of the Vulnerable Software and Affected Versions** amirsanni Mini-Inventory-and-Sales-Management-System version 0.1 **Description** A security flaw allows remote attackers to perform SQL injection, a technique used to interfere with the queries that an application makes to its database. The issue exists in the `Transaction::getAll()` function within the `application/models/Transaction.php` file. The flaw is triggered by manipulating the `orderBy` or `orderFormat` arguments. **Recommendations** As a temporary workaround, restrict access to the `Transaction::getAll()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** lin-snow Ech0 versions prior to 5.4.2 **Description** A security flaw exists in the `MD5Encrypt()` function within the internal/util/crypto/crypto.go file. This issue involves the use of a risky cryptographic algorithm, which could allow for remote exploitation. The attack complexity is high and exploitation is considered difficult. **Recommendations** Update to version 5.4.2. As a temporary mitigation, restrict the use of the `MD5Encrypt()` function.

**Name of the Vulnerable Software and Affected Versions** chenhg5 cc-connect versions prior to 1.4.2 **Description** Remote code injection is possible through the manipulation of the `exec` argument within the `Authenticate()` function located in the core/webhook.go file. **Recommendations** Update to a version newer than 1.4.1. As a temporary workaround, restrict access to the `Authenticate()` function in the core/webhook.go file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** chenhg5 cc-connect versions prior to 1.4.2 **Description** An OS command injection flaw exists in the Management API component within the `shellExecCommand()` function of the `core/engine.go` file. A remote attacker can exploit this by manipulating the `exec` argument to execute arbitrary operating system commands. **Recommendations** Update chenhg5 cc-connect to version 1.4.2 or later. As a temporary mitigation, restrict access to the Management API or avoid using the `shellExecCommand()` function.