][Gb][

**Name of the Vulnerable Software and Affected Versions** Q-News version 2.0 **Description** The issue allows remote attackers to execute arbitrary PHP code via a URL in the `id` parameter in the q-news.php file. **Recommendations** For Q-News version 2.0, consider restricting access to the q-news.php file or validating and sanitizing the `id` parameter to prevent remote file inclusion attacks. As a temporary workaround, avoid using the `id` parameter in the q-news.php file until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Oliver May Athena PHP Website Administration version 0.1a **Description** The issue allows remote attackers to execute arbitrary PHP code via a URL in the `athena dir` parameter in athena.php. **Recommendations** For version 0.1a, consider restricting access to the athena.php file until a patch is available, and avoid using the `athena dir` parameter in the affected endpoint.

**Name of the Vulnerable Software and Affected Versions** phpGreetz versions 0.99 and earlier **Description** The issue allows remote attackers to execute arbitrary PHP code via a URL in the `content` parameter in the content.php file. **Recommendations** For phpGreetz versions 0.99 and earlier, consider disabling the content.php file or restricting access to it until a patch is available. Avoid using the `content` parameter in the affected file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** CaLogic versions 1.22 and earlier **Description** The issue allows remote attackers to obtain sensitive information via a direct request to several API endpoints, including "doclsqlres.php", "clmcpreload.php", "viewhistlog.php", "mcconfig.php", "doclsqlbak.php", "defcalsel.php", or "cl minical.php". These endpoints reveal the path in an error message, potentially exposing sensitive information. **Recommendations** For CaLogic versions 1.22 and earlier, as a temporary workaround, consider restricting access to the vulnerable API endpoints until a patch is available. Avoid making direct requests to these endpoints to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** PHP FirstPost (affected versions not specified) **Description** The issue allows remote attackers to execute arbitrary PHP code via the `Include` parameter in the block.php file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.