Ángel Heredia Pérez

**Name of the Vulnerable Software and Affected Versions** SEUR plugin versions prior to 2.5.11 **Description** The SEUR plugin is vulnerable to time-based SQL injection through the use of the `id order` parameter of the "/modules/seur/ajax/saveCodFee.php" endpoint. This issue affects versions prior to 2.5.11. **Recommendations** For versions prior to 2.5.11, update to version 2.5.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/modules/seur/ajax/saveCodFee.php" endpoint until a patch is available. Avoid using the `id order` parameter in the affected endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** WideStand versions prior to 5.3.5 **Description** The issue is a Cross-site Scripting (XSS) reflected vulnerability. It generates one of the meta tags directly using the content of the queried URL, allowing an attacker to inject HTML/Javascript code into the response. **Recommendations** For versions prior to 5.3.5, update to version 5.3.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the meta tags generation feature until a patch is available. Avoid using user-supplied input in the queried URL to minimize the risk of exploitation.