Vukodlak

**Name of the Vulnerable Software and Affected Versions** mcNews versions 1.3 and earlier **Description** The issue allows remote attackers to execute arbitrary PHP code by modifying the `l` parameter to reference a URL on a remote web server that contains the code. **Recommendations** For mcNews versions 1.3 and earlier, consider restricting access to the install.php file until a patch is available. As a temporary workaround, avoid using the `l` parameter in the install.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.