Ann

Name of the Vulnerable Software and Affected Versions: favethemes Homey versions n/a through 2.4.5 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: For versions n/a through 2.4.5, update to a version that contains a fix for this issue, as the current version is affected by the SQL Injection vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: designthemes LMS versions n/a through 9.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker can inject malicious scripts into the website, potentially stealing user data or taking control of user sessions. Recommendations: For designthemes LMS versions n/a through 9.1, update to a version that includes a fix for this issue, as using outdated versions may expose users to Reflected XSS attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: uxper Sala versions 1.1.3 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions 1.1.3 and earlier, update to a version that fixes this issue, however at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: uxper Nuss versions 1.3.3 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions 1.3.3 and earlier, update to a version that contains a fix for this issue, as no specific fix is provided in the given data. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: WPCRM - CRM for Contact form CF7 & WooCommerce versions through 3.2.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations: For versions through 3.2.0, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** mojoomla WPGYM versions n/a through 65.0 **Description** The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local File Inclusion in mojoomla WPGYM. **Recommendations** For mojoomla WPGYM versions n/a through 65.0, update to a version that fixes the Improper Control of Filename for Include/Require Statement in PHP Program vulnerability. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** mojoomla School Management versions n/a through 93.0.0 **Description** The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion. This is a type of security vulnerability that can be exploited by an attacker to include and execute arbitrary local files on the server. **Recommendations** For mojoomla School Management versions n/a through 93.0.0, consider restricting access to sensitive files and directories to minimize the risk of exploitation. As a temporary workaround, review and validate all include/require statements in PHP programs to ensure they do not allow arbitrary file inclusion. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WPCRM - CRM for Contact form CF7 & WooCommerce versions through 3.2.0 **Description** The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. **Recommendations** For versions through 3.2.0, update to a version that contains a fix for this issue, as using an outdated version may expose the system to SQL Injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.