Wang Jing

**Name of the Vulnerable Software and Affected Versions** 6kbbs versions 7.1 through 8.0 **Description** The issue allows for CSRF attacks via specific API endpoints, including "portalchannel ajax.php" with `id` or `code` parameters, and "admin.php" with a `fileids` parameter. **Recommendations** For versions 7.1 and 8.0, consider restricting access to the "portalchannel ajax.php" and "admin.php" endpoints to minimize the risk of exploitation. As a temporary workaround, avoid using the `id`, `code`, and `fileids` parameters in the affected API endpoints until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** SmartCMS version 2 **Description** The issue concerns multiple cross-site scripting (XSS) vulnerabilities. **Recommendations** For SmartCMS version 2, update to a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Vastal I-Tech phpVID versions 0.9.9 through 1.2.3 **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `order by` parameter in the groups.php file. **Recommendations** For versions 0.9.9 through 1.2.3, consider restricting access to the `order by` parameter in the groups.php file to minimize the risk of exploitation. Avoid using the `order by` parameter until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** DLGuard version 4.5 **Description** The issue allows remote attackers to obtain the installation path. This is achieved via the `c` parameter to the "index.php" endpoint. **Recommendations** For DLGuard version 4.5, consider restricting access to the "index.php" endpoint until a patch is available. As a temporary workaround, avoid using the `c` parameter in the "index.php" endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Ex Libris Patron Directory Services (PDS) NYU OpenSSO Integration versions 2.1 and earlier **Description** The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the `url` parameter. This can be exploited by including a malicious URL in the `url` parameter, potentially leading to phishing attacks. **Recommendations** For Ex Libris Patron Directory Services (PDS) NYU OpenSSO Integration versions 2.1 and earlier, consider restricting access to the logon page or validating the `url` parameter to prevent redirects to arbitrary web sites until a fix is available.