Vaibhav Kubade

**Name of the Vulnerable Software and Affected Versions** ImpressCMS (affected versions not specified) **Description** An authenticated remote code execution issue exists in the custom tag module. Authenticated administrators can execute arbitrary PHP code by storing a malicious payload in a custom tag with the PHP type enabled. The application uses the `undoHtmlSpecialChars()` function to decode HTML-encoded content before passing it to the `eval()` function within the `renderWithPhp()` method, which bypasses HTML Purifier sanitization. The payload is then triggered on every frontend page load via the preload event system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A CMS contains a SQL injection flaw in the 'admin/db data.php' endpoint. Authenticated administrators can inject arbitrary SQL into a SHOW COLUMNS FROM statement by providing unsanitized input via the `table name` GET or POST parameter. This allows for table traversal, time-based blind, boolean-based blind, and error-based injection techniques to enumerate the full database schema and access system tables such as information schema. This disclosure can be chained with secondary injection points to extract credential data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `table name` parameter in the 'admin/db data.php' endpoint until the issue is resolved.

Saurus CMS Community Edition contains an unauthenticated open redirect vulnerability in the logout handling code in classes/port.inc.php, where the url parameter supplied via GET or POST is passed directly to the Location header without domain allowlist, scheme validation, or relative path enforcement. Attackers can craft a malicious logout URL containing an arbitrary external domain or javascript: URI scheme to redirect authenticated users to attacker-controlled phishing pages after session destruction, enabling credential theft and OAuth redirect abuse.

**Name of the Vulnerable Software and Affected Versions** Serendipity versions prior to 2.6.1 **Description** An open redirect issue exists in the 'exit.php' endpoint. Unauthenticated attackers can redirect users to arbitrary external sites by providing a malicious Base64-encoded `url` parameter. This occurs when the Track Exits plugin is configured with the `commentredirection` setting set to 's9y'. This flaw allows attackers to create URLs that appear trusted by using the legitimate blog domain to perform phishing, deliver malware, or bypass URL reputation filters. **Recommendations** Update to version 2.6.1 or later. As a temporary mitigation, avoid configuring the Track Exits plugin with `commentredirection` set to 's9y'.

**Name of the Vulnerable Software and Affected Versions** Serendipity versions prior to 2.6.1 **Description** An authentication context confusion exists where password validation and session loading operate independently without ensuring both use the same user record. This allows an authenticated Editor to create a username collision with an Administrator account, enabling them to obtain administrative privileges by logging in with their own password while the session loads the Administrator's account data. **Recommendations** Update to version 2.6.1 or later.