Xunyang1

**Name of the Vulnerable Software and Affected Versions** 72crm version 9 **Description** The issue is related to an arbitrary file upload vulnerability via the avatar upload function, allowing attackers to execute arbitrary code by uploading a crafted PHP file. **Recommendations** For 72crm version 9, consider disabling the avatar upload function until a patch is available to prevent exploitation of this issue. Restrict access to the vulnerable function to minimize the risk of arbitrary code execution.

**Name of the Vulnerable Software and Affected Versions** 72crm version 9.0 **Description** An issue was discovered in 72crm, where there is a SQL Injection vulnerability in the functionality to View the task calendar. **Recommendations** For 72crm version 9.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** 72crm version 9.0 **Description** The issue is related to an Arbitrary file upload vulnerability. **Recommendations** For 72crm version 9.0, update to a version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** EmpireCMS version 7.5 **Description** The issue is a SQL injection vulnerability located in the AdClass.php file. **Recommendations** For EmpireCMS version 7.5, update to a version that fixes the SQL injection vulnerability in AdClass.php.

**Name of the Vulnerable Software and Affected Versions** Projectworlds Hospital Management System version 1.0 **Description** An issue was discovered that allows unauthorized malicious attackers to add patients without restriction. This is achieved via the `add patient.php` endpoint. **Recommendations** For Projectworlds Hospital Management System version 1.0, consider restricting access to the `add patient.php` endpoint until a patch is available. As a temporary workaround, limit the functionality of this endpoint to authorized users only. At the moment, there is no information about a newer version that contains a fix for this vulnerability.