Choco094Late

**Name of the Vulnerable Software and Affected Versions** Code-Projects Student Web Portal version 1.0 **Description** A SQL injection issue exists in Code-Projects Student Web Portal 1.0. The issue is located in the `profile.php` file, specifically through manipulation of the `User` argument. This allows for remote exploitation. The exploit has been publicly released. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** code-projects Student Web Portal version 1.0 **Description** A flaw exists in the Student Web Portal that allows for remote sql injection. The issue is located in the `valreg passwdation` function of the `signup.php` file. The `reg passwd` argument can be manipulated to exploit this flaw. The exploit is publicly available. **Recommendations** Apply a fix to address the sql injection issue in the `valreg passwdation` function of the `signup.php` file.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Simple Responsive Tourism Website version 1.0 **Description** A SQL injection issue exists in the Login component of the software, specifically within the `/tourism/classes/Login.php?f=login` file. The `Username` argument is susceptible to manipulation, potentially allowing for remote exploitation. The exploit has been publicly disclosed. **Recommendations** Apply any available updates or patches to address the SQL injection issue in the `/tourism/classes/Login.php?f=login` file. As a temporary workaround, consider sanitizing the `Username` input to prevent SQL injection attacks.

**Nome do Software Vulnerável e Versões Afetadas** huggingface smolagents versão 1.24.0 **Descrição** Existe uma vulnerabilidade no componente `LocalPythonExecutor` do software. As funções `requests.get` e `requests.post` são afetadas, potencialmente levando à falsificação de requisição do lado do servidor. Esse problema pode ser explorado remotamente. A exploração está publicamente disponível. O fornecedor foi notificado, mas não respondeu. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Simple Responsive Tourism Website version 1.0 **Description** A flaw exists in SourceCodester Simple Responsive Tourism Website that allows for cross site scripting. This issue is triggered through manipulation of the `Title` argument in the file `/tourism/classes/Master.php?f=save package`. The attack can be launched remotely. The exploit details have been publicly released. **Recommendations** Apply any available updates to address the issue in the affected file `/tourism/classes/Master.php?f=save package`. As a temporary workaround, consider sanitizing the `Title` input to prevent the injection of malicious scripts.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Simple Responsive Tourism Website version 1.0 **Description** A flaw exists in SourceCodester Simple Responsive Tourism Website version 1.0, specifically within an unknown function of the file `/tourism/classes/Master.php?f=register` related to the Registration component. Manipulation of the `firstname`, `lastname`, and `username` arguments can lead to cross site scripting. The attack can be launched remotely. An exploit has been published. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Nome do Software Vulnerável e Versões Afetadas** projectworlds Advanced Library Management System versão 1.0 **Descrição** Existe uma vulnerabilidade de injeção de SQL no projectworlds Advanced Library Management System versão 1.0. O problema está localizado no arquivo `/borrowed book search.php`, dentro de uma função desconhecida. A manipulação dos argumentos `datefrom` e `dateto` pode levar à injeção de SQL. O ataque pode ser iniciado remotamente e os detalhes do exploit foram divulgados publicamente. **Recomendações** Aplique uma correção para o projectworlds Advanced Library Management System versão 1.0 para resolver o problema de injeção de SQL no arquivo `/borrowed book search.php`. Como solução temporária, restrinja o acesso ao arquivo `/borrowed book search.php` para minimizar o risco de exploração.