Toan Le

**Name of the Vulnerable Software and Affected Versions** DP Calendar versions 5.5.0 through 10.11.2 **Description** An authenticated and privileged blind SQL injection exists within the content plugin. This issue occurs when saving an article, provided the user has update permissions for articles. Blind SQL injection is a technique where an attacker asks the database true or false questions and determines the answer based on the application's response. **Recommendations** Update DP Calendar to a version later than 10.11.2.

**Name of the Vulnerable Software and Affected Versions** DP Calendar versions 7.0.0 through 10.11.2 **Description** An authenticated user with create permissions in DPCalendar can execute a stored Cross-Site Scripting (XSS) attack. This occurs because the location title is rendered in a data attribute without proper escaping, allowing the injection of malicious scripts. **Recommendations** Update DP Calendar to a version later than 10.11.2.

**Name of the Vulnerable Software and Affected Versions** JoomGallery versions prior to 4.3.1 **Description** An unauthenticated access control bypass exists in the category JSON view. While the HTML view correctly enforces password protection for gallery categories, the JSON view fails to perform this check when the `format` parameter is set to `json`. **Recommendations** Update to version 4.3.1 or later. Avoid using the `format` parameter with the value `json` in category views until the update is applied.

**Name of the Vulnerable Software and Affected Versions** JoomGallery versions prior to 4.4.0 **Description** An authenticated user with privileged access can store a Cross-Site Scripting (XSS) payload within an image. This allows the execution of arbitrary JavaScript in the browser of every visitor who views the affected image. **Recommendations** Update JoomGallery to version 4.4.0 or later.

**Name of the Vulnerable Software and Affected Versions** J2Store versions 1.0.0 through 3.3.20 J2Store versions 4.0.0 through 4.0.20 J2Store versions 4.1.0 through 4.1.5 **Description** Stored Cross-Site Scripting (XSS) exists in the guest checkout billing address fields. An unauthenticated attacker can store unsanitized HTML in fields such as `billing first name` by exploiting a filter bypass in the `Input::getArray()` function combined with the PHP `variables order=EGPCS` configuration, where cookies override POST data in the `$ REQUEST` superglobal. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Phoca Download versions 5.0.0 through 6.1.4 **Description** Reflected Cross-Site Scripting (XSS) occurs when an application includes untrusted data in a web page without proper validation or encoding, allowing an attacker to execute malicious scripts in the victim's browser. This issue is triggered via the `search` GET parameter. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Phoca Cart versions 5.0.0 through 6.1.7 **Description** Stored Cross-Site Scripting (XSS) occurs in the Admin Order View. The issue is triggered via the `User-Agent` header, allowing an attacker to inject malicious scripts that are stored and subsequently executed in the administrator's browser. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Phoca Cart versions 5.0.0 through 6.1.7 **Description** Reflected Cross-Site Scripting (XSS) occurs when an application includes untrusted data in a web page without proper validation or encoding, allowing an attacker to execute malicious scripts in the victim's browser. This issue is triggered via the `price from` and `price to` filter parameters. **Recommendations** Update Phoca Cart to a version newer than 6.1.7. As a temporary workaround, restrict or sanitize the input for the `price from` and `price to` parameters.

**Name of the Vulnerable Software and Affected Versions** Phoca Cart versions 5.0.0 through 6.1.16 **Description** An unauthenticated attacker can perform a SQL injection on the public shop items page. The issue occurs because the GET array parameters `a[]` (attribute) and `s[]` (specification) are concatenated directly into SQL WHERE clauses without proper parameterization or escaping. This allows for full database extraction using time-based blind techniques, where the attacker infers data by observing the time the server takes to respond to specific queries. **Recommendations** Update Phoca Cart to a version newer than 6.1.16. As a temporary mitigation, restrict access to the public shop items page or filter the `a[]` and `s[]` parameters at the web application firewall level.

**Name of the Vulnerable Software and Affected Versions** Phoca Commander versions 1.0.0 through 6.1.3 **Description** Improper limitation of paths in the `getSource()` function allows for an arbitrary file read, enabling an attacker to access files on the server that should be restricted. **Recommendations** Update Phoca Commander to a version later than 6.1.3. As a temporary workaround, restrict access to the `getSource()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Phoca Commander versions 1.0.0 through 6.1.3 **Description** Improper limitation of paths for delete, copy, and move actions leads to path traversal, a condition where an attacker can access files and directories outside the intended folder by manipulating file paths. **Recommendations** Update Phoca Commander to a version newer than 6.1.3.

**Name of the Vulnerable Software and Affected Versions** Phoca Commander versions 1.0.0 through 6.1.3 **Description** Improper limitation of paths in the file upload action allows for a path traversal, which occurs when an application uses user-controllable input to construct a pathname that is used in a file system operation, potentially allowing access to files outside the intended directory. **Recommendations** Update Phoca Commander to a version newer than 6.1.3.