Nexus

**Name of the Vulnerable Software and Affected Versions** SineCms version 2.3.4 **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `stringa` parameter in the mods/Core/result.php file. **Recommendations** For SineCms version 2.3.4, consider restricting access to the mods/Core/result.php file until a patch is available, and avoid using the `stringa` parameter in the affected API endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Melange Chat Server (aka M-Chat) (affected versions not specified) **Description** The issue allows local users on a server to potentially gain sensitive information, such as credentials, by exploiting how the Melange Chat Server handles cookies and other sensitive information when accessed via a web browser. When a user clicks on a link with a specified port, the server automatically sends cookies and other sensitive information, which can be read from HTTP headers by setting up a listening port. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.