Wr0Ld

**Name of the Vulnerable Software and Affected Versions** macrozheng mall version 0504e86 **Description** A flaw in the `mall-portal` module allows for weak password recovery. The issue resides in the `/sso/getAuthCode` endpoint. A remote attacker can execute a manipulation to exploit this, although the attack is characterized by high complexity and difficult exploitability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ruoyi-vue-pro versions prior to 2026.04-jdk8-SNAPSHOT **Description** A path traversal issue exists in the AppFileController File Upload Endpoint. The flaw is located within the `generateUploadPath()` function of the `FileServiceImpl.java` file. This allows a remote attacker to perform a manipulation that results in unauthorized access to files or directories outside the intended folder. **Recommendations** Apply patch 4ae3f6b2c9883978837638c14e3d18419819eeb0 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** yashpokharna2555 restaurent-management-system (affected versions not specified) **Description** An issue exists in the POST Parameter Handler component within the `/forgotpassword.php` file. Remote manipulation of the `email` parameter allows for SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** yashpokharna2555 restaurent-management-system (affected versions not specified) **Description** A security flaw exists in the Registration Handler component within the `login register.php` file. A remote attacker can perform cross-site scripting (XSS)—a technique used to inject malicious scripts into web pages viewed by other users—by manipulating the `Username` argument. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mohammed-eid35 bank-management-system-springboot versions prior to 7b9bcc65ad7df3db29af71aed9bb500e5f24d948 **Description** An issue in the Transaction Endpoint component, specifically within the file `src/main/java/com/alien/bank/management/system/controller/TransactionController.java`, allows for improper authorization. This flaw can be exploited remotely. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.