Afeng2016-So

**Name of the Vulnerable Software and Affected Versions** Perfree PerfreeBlog version 3.1.2 **Description** An issue in Perfree PerfreeBlog allows a remote attacker to execute arbitrary code via a crafted plugin listed in "admin/plugin/access/list". **Recommendations** For Perfree PerfreeBlog version 3.1.2, consider disabling the plugin functionality until a patch is available to prevent remote code execution. Restrict access to the "admin/plugin/access/list" endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** pf4j versions 3.9.0 and earlier **Description** An issue in pf4j allows a remote attacker to obtain sensitive information and execute arbitrary code via the `zippluginPath` parameter. **Recommendations** For pf4j versions 3.9.0 and earlier, consider restricting access to the `zippluginPath` parameter to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Newbee-Mall version 1.0.0 **Description** A cross-site scripting issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `goodsName` parameter in the "/admin/goods/update" API endpoint. **Recommendations** For Newbee-Mall version 1.0.0, avoid using the `goodsName` parameter in the "/admin/goods/update" API endpoint until the issue is resolved. Consider validating and sanitizing user input to prevent malicious payloads.

**Name of the Vulnerable Software and Affected Versions** Newbee-Mall version 1.0.0 **Description** The issue allows for arbitrary file upload via the `Upload` function at the "/admin/goods/edit" API endpoint. **Recommendations** For Newbee-Mall version 1.0.0, consider disabling the `Upload` function at the "/admin/goods/edit" endpoint until a patch is available to prevent exploitation.

**Name of the Vulnerable Software and Affected Versions** DoraCMS version 2.1.8 **Description** A stored cross-site scripting (XSS) issue in the /admin/contenttemp component allows attackers to execute arbitrary web scripts or HTML via a crafted payload. **Recommendations** For DoraCMS version 2.1.8, consider disabling access to the /admin/contenttemp component until a patch is available to prevent exploitation of the stored XSS issue.

**Name of the Vulnerable Software and Affected Versions** TMS version 2.28.0 **Description** A cross-site scripting (XSS) issue was found in the /TMS/admin/setting/mail/createorupdate component. **Recommendations** For TMS version 2.28.0, update to a version that includes a fix for this issue, as no specific workaround is provided for this version.

**Name of the Vulnerable Software and Affected Versions** TMS version 2.28.0 **Description** The issue is related to insecure permissions in the component "/TMS/admin/user/Update2". This allows attackers to modify the administrator account and password. **Recommendations** For TMS version 2.28.0, consider restricting access to the "/TMS/admin/user/Update2" component until a patch is available to prevent modification of the administrator account and password.

**Name of the Vulnerable Software and Affected Versions** OneBlog versions 2.2.8 and earlier **Description** The issue allows low-level administrators to delete high-level administrators beyond their authority due to insecure permissions. **Recommendations** For OneBlog versions 2.2.8 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.