David Álvarez Robles

**Name of the Vulnerable Software and Affected Versions** M4 PDF plugin for Prestashop sites versions 3.2.3 and before **Description** The issue is related to a directory traversal vulnerability. The `f` parameter is not properly checked in the resource "/m4pdf/pdf.php", allowing an attacker to download any file given its relative path. This could potentially enable an attacker to access sensitive files, such as "/etc/passwd", if they exist on the server. **Recommendations** For versions 3.2.3 and before, consider disabling the "/m4pdf/pdf.php" resource or restricting access to it until a patch is available. Additionally, avoid using the `f` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** M4 PDF plugin for Prestashop sites versions 3.2.3 and before **Description** The M4 PDF plugin for Prestashop sites is vulnerable to an arbitrary HTML Document crafting vulnerability. The resource "/m4pdf/pdf.php" uses templates to dynamically create documents. If the template does not exist, the application returns a fixed document with a message in mpdf format. An attacker could exploit this vulnerability by inputting a valid HTML/CSS document as the value of the `parameter`. **Recommendations** For versions 3.2.3 and before, as a temporary workaround, consider restricting access to the "/m4pdf/pdf.php" endpoint until a patch is available. Avoid using the vulnerable parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Visforms Base Package for Joomla 3 (affected versions not specified) **Description** The issue allows an attacker to interact with the database, potentially enabling them to read, modify, and delete data, due to the use of concatenation in constructing SQL queries. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Nome do software vulnerável e versões afetadas** Versões do plugin Themify Post Type Builder Search Addon para WordPress anteriores à 1.4.0 **Descrição** O problema decorre da falha do plugin em escapar adequadamente a URL da página atual antes de reutilizá-la em um atributo HTML, levando a uma vulnerabilidade de cross-site scripting refletido. **Recomendações** Para versões anteriores à 1.4.0, atualize para a versão 1.4.0 ou posterior para resolver o problema.

**Nome do software vulnerável e versões afetadas** Versões do Enfold anteriores à 4.8.4 **Descrição** O tema Enfold para WordPress está afetado por uma vulnerabilidade de Cross-Site Scripting (XSS) refletido. Essa vulnerabilidade está presente nas versões do Enfold que utilizam o Avia Page Builder e são anteriores à versão 4.8.4. **Recomendações** Para versões do Enfold anteriores à 4.8.4, atualize para a versão 4.8.4 ou posterior para resolver a vulnerabilidade. Como solução temporária, considere restringir o acesso ao Avia Page Builder até que a atualização seja aplicada.