0O_Zeus_O0

**Name of the Vulnerable Software and Affected Versions** Rigter Portal System (RPS) versions 1.0 through 3.0 **Description** The issue allows remote attackers to bypass authentication and upload arbitrary files. This can be achieved via direct requests to API endpoints such as "adm/photos/images.php" and "adm/down/files.php". **Recommendations** For versions 1.0 through 3.0, restrict access to the "adm/photos/images.php" and "adm/down/files.php" API endpoints to prevent unauthorized file uploads. Consider implementing proper authentication mechanisms to prevent bypass attacks.

**Name of the Vulnerable Software and Affected Versions** Rigter Portal System (RPS) versions 1.0 through 3.0 **Description** The issue allows remote attackers to read arbitrary files via ".." sequences in the `id` parameter of the index.php file. **Recommendations** For versions 1.0 through 3.0, consider restricting access to the index.php file or validating the `id` parameter to prevent directory traversal attacks.

**Name of the Vulnerable Software and Affected Versions** Rigter Portal System (RPS) versions 1.0 through 3.0 **Description** The issue allows remote attackers to add arbitrary content and conduct cross-site scripting (XSS) attacks via a direct request to the "add art.php" endpoint. Initially, it was reported as a potential SQL injection issue, but this classification is unlikely. **Recommendations** For versions 1.0 through 3.0, consider restricting access to the "add art.php" endpoint until a proper fix is implemented to prevent arbitrary content addition and XSS attacks.

**Name of the Vulnerable Software and Affected Versions** JetPhoto (affected versions not specified) **Description** The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur via the `page` parameter in several API endpoints: "/Classic.view/thumbnail.php", "/Classic.view/gallery.php", "/Classic.view/detail.php", or "/Orange.view/detail.php"; or via the `name` parameter in the "/Orange.view/slideshow.php" endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SimpBook version 1.0 **Description** A cross-site scripting (XSS) issue exists due to the failure to properly sanitize user input. When the `html enable` option is enabled, remote attackers can inject arbitrary web script or HTML via the `message` parameter to "index.php". This allows for the execution of malicious code on the victim's browser. **Recommendations** For SimpBook version 1.0, as a temporary workaround, consider disabling the `html enable` option until a patch is available. Restrict access to the "index.php" endpoint to minimize the risk of exploitation. Avoid using the `message` parameter in the affected endpoint until the issue is resolved.