Zsmaaa

Name of the Vulnerable Software and Affected Versions Cyber-III Student-Management-System (affected versions not specified) Description Um problema de scripting entre sites existe devido à manipulação do argumento `batch` no Endpoint de Exclusão de Horário de Aula, especificamente dentro do arquivo '/admin/class%20schedule/delete batch.php'. O ataque pode ser lançado remotamente. A exploração foi divulgada publicamente. Recommendations Atualmente, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

Name of the Vulnerable Software and Affected Versions Textpattern versões anteriores a 4.9.2 Description Existe uma falha de segurança no Textpattern até a versão 4.9.1. A função `mt uploadImage` dentro do arquivo `rpc/TXP RPCServer.php`, parte do componente XML-RPC Handler, é suscetível a travessia de caminho devido à manipulação do argumento `file.name`. Isso permite a exploração remota. Os detalhes da exploração foram divulgados publicamente. Recommendations Atualize para a versão 4.9.2 ou posterior.

**Name of the Vulnerable Software and Affected Versions** Acrel Environmental Monitoring Cloud Platform version 1.1.0 **Description** A flaw exists in Acrel Environmental Monitoring Cloud Platform that allows for unrestricted file uploads due to manipulation of an unknown process. The issue can be exploited remotely. The exploit has been publicly released. **Recommendations** Update to a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** doramart DoraCMS versions 3.0.x **Description** A flaw exists in the processing of the `/api/v1/mail/send` file within the Email API component. This improper handling results in insufficient authentication. Remote attackers can exploit this issue. The exploit is publicly available. The vendor was notified but did not respond. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DoraCMS versions 3.0.x **Description** A security flaw exists in DoraCMS 3.0.x related to path traversal. This issue is present in the `createFileBypath` function within the `/DoraCMS/server/app/router/api/v1.js` file. A manipulation of the system allows for path traversal, and the attack can be initiated remotely. The exploit has been publicly released. The vendor was notified but did not respond. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ShuoRen Smart Heating Integrated Management Platform version 1.0.0 **Description** A flaw exists in ShuoRen Smart Heating Integrated Management Platform version 1.0.0, related to an unknown functionality within the file `/MP/Service/Webservice/ExampleNodeService.asmx`. Manipulation of the `File` argument can lead to unrestricted file upload, allowing for remote exploitation. The exploit has been published. The vendor was contacted but did not respond. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.