Zbigniew Piotrak

**Name of the Vulnerable Software and Affected Versions** OutSystems Service Center versions prior to 11.41.2 OutSystems Lifetime versions prior to 11.28.2.3955 **Description** OutSystems Service Center is subject to a DOM-based Cross-Site Scripting (XSS) issue, where a low-privileged attacker can execute JavaScript code by uploading a file with a malicious filename. This occurs in any location where files are attached for server upload. OutSystems Lifetime contains an authorization bypass flaw involving the `ApplicationID` parameter. This allows any authenticated user to access the Change Log, exposing application names and actions performed by other users. **Recommendations** Update OutSystems Service Center to version 11.41.2. Update OutSystems Lifetime to version 11.28.2.3955.

**Name of the Vulnerable Software and Affected Versions** Avada (Fusion) Builder plugin for WordPress versions prior to 3.15.6 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts through the `Module Title` parameter. These scripts execute whenever a user accesses the affected page. **Recommendations** Update the Avada (Fusion) Builder plugin for WordPress to version 3.15.6 or later.

**Name of the Vulnerable Software and Affected Versions** OutSystems Lifetime versions prior to 11.28.2.3955 **Description** An authorization bypass exists where an authenticated user can manipulate the `ApplicationID` parameter to gain unauthorized access. This allows the user to read the Change Log, which contains actions performed by other users and the names of any application. **Recommendations** Update to version 11.28.2.3955.

**Name of the Vulnerable Software and Affected Versions** Betheme theme for WordPress versions prior to 28.1.7 **Description** The theme is susceptible to Stored Cross-Site Scripting through the `page title` parameter. Insufficient input sanitization and output escaping in theme breadcrumbs allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. **Recommendations** Update to version 28.1.7 or later.