Alexperrakis

**Name of the Vulnerable Software and Affected Versions** horilla-opensource horilla versions up to 1.0.2 **Description** A security issue exists in horilla-opensource horilla, specifically within the Leads Module. The manipulation of the `Notes` argument in an unknown function of the file static/assets/js/global.js can lead to cross-site scripting (XSS). This attack can be carried out remotely. The exploit has been published. **Recommendations** Upgrade to version 1.0.3 to address this issue.

**Name of the Vulnerable Software and Affected Versions** horilla-opensource horilla versions up to 1.0.2 **Description** A flaw exists in the Query Parameter Handler component of horilla-opensource horilla. Specifically, the `get` function within the `horilla generics/global search.py` file is susceptible to an open redirect condition. Manipulation of the `prev url` argument can lead to exploitation. The exploit is publicly available. **Recommendations** Upgrade to version 1.0.3.

**Name of the Vulnerable Software and Affected Versions** tushar-2223 Hotel-Management-System versions up to bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15 **Description** A security flaw exists in tushar-2223 Hotel-Management-System. The issue is related to SQL injection within the HTTP POST Request Handler component, specifically affecting the file `/home.php`. Manipulation of the `Name/Email` argument can trigger the injection. This attack can be initiated remotely. The exploit has been publicly released. Continuous delivery with rolling releases is used, and no specific version details for affected or updated releases are available. The vendor was contacted but did not respond. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CloudPanel Community Edition versions up to 2.5.1 **Description** A security issue exists in CloudPanel Community Edition. The problem involves an open redirect through manipulation of the `Referer` argument within an unknown function of the `/admin/users` file, related to the HTTP Header Handler component. This manipulation allows for remote attacks. The exploit has been publicly disclosed. **Recommendations** Upgrade to version 2.5.2 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Eigenfocus versions prior to 1.4.1 **Description** A security issue exists in Eigenfocus related to the Description Handler component. Manipulating the `entry.description`/`time entry.description` argument can lead to cross site scripting. This attack can be carried out remotely. The exploit has been publicly disclosed. **Recommendations** Upgrade to version 1.4.1 to resolve this issue.

**Name of the Vulnerable Software and Affected Versions** Mist Community Edition versions up to 4.7.1 **Description** A problematic issue has been found in the Authentication Endpoint component, specifically in the Login function of the file src/mist/api/views.py. The manipulation of the `return to` argument leads to cross-site scripting. This issue can be exploited remotely. **Recommendations** For Mist Community Edition versions up to 4.7.1, upgrade to version 4.7.2 to address this issue.

**Name of the Vulnerable Software and Affected Versions** Mist Community Edition versions up to 4.7.1 **Description** A problem was found in the function `tag resources` of the file `src/mist/api/tag/views.py`. The manipulation of the argument `tag` leads to cross-site scripting. The attack may be initiated remotely. It is reported that the estimated number of potentially affected devices is not provided. **Recommendations** For Mist Community Edition versions up to 4.7.1, upgrade to version 4.7.2 to address this issue. As a temporary workaround, consider restricting access to the `tag resources` function until the patch is applied.

**Name of the Vulnerable Software and Affected Versions** Mist Community Edition versions up to 4.7.1 **Description** A vulnerability was found in the function `session start response` of the file `src/mist/api/auth/middleware.py`. This issue leads to cross-site request forgery and can be initiated remotely. **Recommendations** For Mist Community Edition versions up to 4.7.1, upgrade to version 4.7.2 to address this issue.

**Name of the Vulnerable Software and Affected Versions** Mist Community Edition versions up to 4.7.1 **Description** A critical issue has been found, affecting the `create token` function of the API Token Handler component. This leads to improper access controls, allowing remote attacks. The issue has been publicly disclosed and may be exploited. **Recommendations** For Mist Community Edition versions up to 4.7.1, upgrade to version 4.7.2 to address this issue. As a temporary workaround, consider restricting access to the `create token` function of the API Token Handler component until the upgrade is applied.

**Name of the Vulnerable Software and Affected Versions** Summer Pearl Group Vacation Rental Management Platform version 1.0.1 **Description** A vulnerability was found in the Summer Pearl Group Vacation Rental Management Platform, affecting an unknown part of the file /spgpm/updateListing. The manipulation of the argument `spgLsTitle` leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For Summer Pearl Group Vacation Rental Management Platform version 1.0.1, upgrade to version 1.0.2 to address this issue. As a temporary workaround, consider restricting access to the `/spgpm/updateListing` endpoint until the upgrade is applied. Additionally, avoid using the `spgLsTitle` argument in the affected endpoint until the issue is resolved.