Alexander Fuchs

**Name of the Vulnerable Software and Affected Versions** Akiva WebBoard versions prior to 8 SR 1 **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `name` parameter in the WB/Default.asp file. **Recommendations** For versions prior to 8 SR 1, update to version 8 SR 1 or later to resolve the issue. As a temporary workaround, consider restricting access to the WB/Default.asp file to minimize the risk of exploitation. Avoid using the `name` parameter in the affected file until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Akiva WebBoard versions 8.x **Description** The issue allows local users to obtain sensitive information by reading from the database because passwords are stored in plaintext. **Recommendations** For Akiva WebBoard versions 8.x, update the software to a version that securely stores passwords, such as hashed versions, to prevent unauthorized access to sensitive information.

**Name of the Vulnerable Software and Affected Versions** OSCommerce Online Merchant version 3.0.2 **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `value title` parameter. This can be demonstrated using the "Front" field in the shirt module. **Recommendations** For OSCommerce Online Merchant version 3.0.2, avoid using the `value title` parameter in the affected API endpoint until the issue is resolved. As a temporary workaround, consider restricting access to the `main.php` page in the `osCommerce/OM/Core/Site/Shop/Application/Cart/pages` directory to minimize the risk of exploitation.