Yhalo-Wyh

**Name of the Vulnerable Software and Affected Versions** Admidio versions prior to 5.0.11 **Description** Cross-Site Request Forgery (CSRF) occurs because the application fails to validate the `adm csrf token` in the 'modules/category-report/preferences.php' endpoint. This allows an attacker to trick an authenticated administrator into visiting a crafted URL to perform persistent Category Report configuration changes, such as deleting or duplicating configurations, via GET parameters. This issue impacts the integrity and availability of the module configuration. **Recommendations** Update to version 5.0.11 or later.

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions prior to 4.1.5 **Description** Inconsistent filtering of `active=yes` and `publication-date` across public API endpoints allows unauthenticated users to retrieve inactive FAQ content, such as drafts or items pending review. This occurs at the following endpoints: - '/api/v3.1/faq/{categoryId}/{faqId}' returns the inactive FAQ title and full answer. - '/api/v3.1/faqs/tags/{tagId}' and '/api/v4.0/faqs/tags/{tagId}' return the inactive FAQ title and an answer preview. **Recommendations** Update to version 4.1.5 or later.