Arkadiusz Marta

**Name of the Vulnerable Software and Affected Versions** Quick.CMS versions prior to 6.8 **Description** Quick.CMS deserializes user-controlled data received over plaintext HTTP without ensuring integrity or authenticity. This allows attackers to tamper with serialized payloads in transit and inject malicious objects. Because deserialization is performed without proper validation or class restrictions, crafted payloads can trigger dangerous magic methods, such as ` wakeup()` and ` destruct()`, and leverage gadget chains to achieve arbitrary code execution. Exploitation occurs automatically when an administrator accesses the admin panel. **Recommendations** Update to version 6.8 or later to ensure communication is limited to HTTPS.

**Name of the Vulnerable Software and Affected Versions** Canarytokens versions sha-c0f3cf142 through sha-08c3f93d **Description** An HTML injection issue exists in the "fetch links" email sent by Thinkst Applied Research Canarytokens. This allows for Interface Manipulation and Cross-Site Scripting (XSS), which occurs when email clients render HTML emails. **Recommendations** Update Canarytokens to version sha-08c3f93d or later.

**Name of the Vulnerable Software and Affected Versions** Bludit versions prior to 3.18.4 **Description** The API plugin in Bludit allows a user with a valid API token to upload files of any type and extension without restriction. Successful exploitation of this issue can lead to Remote Code Execution. The API endpoint used for file upload does not properly validate the uploaded file's type or extension, allowing an attacker to upload and execute malicious files. The vulnerable parameter is the file itself, uploaded through the API. **Recommendations** Update to version 3.18.4 or later.

**Name of the Vulnerable Software and Affected Versions** Bludit versions prior to 3.18.3 **Description** Bludit is susceptible to Stored Cross-Site Scripting (XSS) through its image upload feature. An authenticated attacker possessing content upload permissions—like Author, Editor, or Administrator—can upload a malicious SVG file. This payload executes when a user accesses the URL of the uploaded file, and the resource is accessible without authentication. **Recommendations** Update to version 3.18.3 or later.

**Name of the Vulnerable Software and Affected Versions** Bludit versions prior to 3.17.2 **Description** Bludit allows a user's session identifier to be set before authentication. The session ID remains consistent even after authentication, potentially allowing an attacker to fixate a session ID for a victim and subsequently hijack the authenticated session. **Recommendations** Update to version 3.17.2 or later.

**Name of the Vulnerable Software and Affected Versions** PluXml CMS versions 5.8.21 and 5.9.0-rc7 **Description** PluXml CMS contains a Stored Cross-Site Scripting (XSS) issue within the Static Pages editing functionality. An attacker possessing editing privileges can inject arbitrary HTML and JavaScript code into a website. This injected code will be rendered and executed when a user visits the edited page. The vendor was notified of this issue but did not provide details regarding vulnerable version ranges. **Recommendations** Update to a newer version of PluXml CMS that addresses this vulnerability. As a temporary workaround, carefully review and sanitize all content added to Static Pages before publishing. Restrict editing privileges to trusted users only.

**Name of the Vulnerable Software and Affected Versions** PluXml CMS versions 5.8.21 and 5.9.0-rc7 **Description** PluXml CMS allows a user’s session identifier to be set before authentication. The value of this session ID remains consistent even after authentication. This behavior allows an attacker to fix a session ID for a victim and subsequently hijack the authenticated session. **Recommendations** Update to a newer version of PluXml CMS that addresses this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PluXml CMS versions 5.8.21 and 5.9.0-rc7 **Description** PluXml CMS contains a Stored Cross-Site Scripting (XSS) issue in the file uploading functionality. An authenticated attacker can upload a malicious SVG file. Clicking the link associated with the uploaded image, or directly accessing the file, can execute the embedded payload. The vendor was notified but did not provide details about the vulnerability or vulnerable version range. **Recommendations** Update to a newer version of PluXml CMS that addresses this issue. Avoid uploading SVG files from untrusted sources. As a temporary workaround, consider restricting file uploads to only trusted file types.

**Name of the Vulnerable Software and Affected Versions** Quick.Cart version 6.7 **Description** Quick.Cart is susceptible to a reflected cross-site scripting (XSS) issue through the `sSort` parameter. An attacker can create a malicious URL that, when accessed, leads to the execution of arbitrary JavaScript code within the victim's browser. The vendor was informed of this issue but did not provide details regarding vulnerable versions. The API endpoint potentially affected is not specified. The vulnerable parameter is `sSort`. **Recommendations** Apply a fix for Quick.Cart version 6.7.

**Name of the Vulnerable Software and Affected Versions** Quick.Cart version 6.7 Quick.Cart (affected versions not specified) **Description** Quick.Cart is susceptible to Local File Inclusion and Path Traversal issues within its theme selection process. A user with sufficient privileges can upload arbitrary file content, with validation limited to the filename extension. This allows an attacker to include and execute uploaded PHP code, potentially leading to Remote Code Execution on the server. The vendor was contacted regarding this issue but did not provide details about vulnerable versions or a response. The API endpoint involved in theme selection is not specified. The vulnerable parameter is not specified. The vulnerable function is not specified. **Recommendations** Quick.Cart version 6.7 should be updated when a fix becomes available. For all other affected versions, update when a fix becomes available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QuickCMS version 6.8 **Description** A Blind SQL injection issue exists in QuickCMS. The issue stems from inadequate input validation when a high-privileged user provides input to the `aFilesDelete` functionality, which can lead to Blind SQL Injection attacks. The `aFilesDelete` function is vulnerable. **Recommendations** QuickCMS version 6.8: Address the improper neutralization of input provided to the `aFilesDelete` functionality.

**Name of the Vulnerable Software and Affected Versions** Strapi versions prior to 5.24.1 **Description** Strapi utilizes JSON Web Tokens (JWT) for authentication. Following logout or account deactivation, JWTs are not invalidated, enabling an attacker with a stolen or intercepted token to reuse it until its expiration. The default expiration is 30 days, but this can be modified. The '/admin/renew-token' API endpoint allows indefinite renewal of near-expiration tokens, amplifying the impact of this issue. **Recommendations** Update to version 5.24.1 or later.

**Name of the Vulnerable Software and Affected Versions** Payload versions prior to 3.44.0 **Description** A session fixation issue existed in Payload's SQLite adapter due to identifier reuse during account creation. An attacker could create an account, save its JSON Web Token (JWT), delete the account, and then reuse the JWT to authenticate as a subsequent user. **Recommendations** Update to version 3.44.0 or later.

**Name of the Vulnerable Software and Affected Versions** Payload versions prior to 3.44.0 **Description** Payload utilizes JSON Web Tokens (JWT) for authentication. Following a user logout, the JWT is not invalidated, enabling an attacker who has obtained a valid token—through theft or interception—to reuse it until its expiration date. The default expiration date is two hours, but this duration is configurable. **Recommendations** Update to version 3.44.0 or later.