Badboycxcc

**Name of the Vulnerable Software and Affected Versions** XXL-JOB versions 2.2.0 and prior **Description** The issue concerns a Command execution vulnerability in background tasks, which is disputed as it may be an intended use case for running arbitrary Bash scripts on behalf of users. **Recommendations** For XXL-JOB versions 2.2.0 and prior, consider restricting the execution of background tasks or limiting the ability to run arbitrary Bash scripts to minimize potential risks until a clearer resolution or guidance is provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SolarView Compact version 6.0 **Description** The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability was found in the Solar AiConf.php component. **Recommendations** For SolarView Compact version 6.0, update to a version that fixes the XSS vulnerability in the Solar AiConf.php component. As a temporary workaround, consider restricting access to the Solar AiConf.php component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SolarView Compact version 6.0 **Description** The issue allows attackers to execute arbitrary code via a crafted php file, exploiting an arbitrary file upload vulnerability in the /images/background/1.php endpoint. **Recommendations** For SolarView Compact version 6.0, consider disabling the /images/background/1.php endpoint until a patch is available to prevent arbitrary file uploads and subsequent code execution.

**Name of the Vulnerable Software and Affected Versions** NUUO Network Video Recorder NVRsolo version 03.06.02 **Description** A reflected cross-site scripting (XSS) issue was found in the login.php file. This issue can be exploited via the "login.php" endpoint. The estimated number of potentially affected devices worldwide is not specified. Details about real-world incidents where this issue was exploited are not provided. **Recommendations** For version 03.06.02, consider disabling access to the "login.php" endpoint until a patch is available. As a temporary workaround, restrict the use of the login functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NETGEAR ProSafe SSL VPN firmware versions FVS336Gv2 and FVS336Gv3 **Description** The issue is related to a SQL injection vulnerability via `USERDBDomains.Domainname` at "cgi-bin/platform.cgi". This vulnerability may allow a remote attacker to execute arbitrary SQL queries. **Recommendations** For versions FVS336Gv2 and FVS336Gv3, as a temporary workaround, consider restricting access to the "cgi-bin/platform.cgi" endpoint until a patch is available. Avoid using the `USERDBDomains.Domainname` variable in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WAVLINK WN535 G3 (affected versions not specified) **Description** The issue exists due to inadequate protection of the web page structure in the /cgi-bin/login.cgi component of the WAVLINK WN535 G3 WiFi repeater's firmware. This allows a remote attacker to conduct a cross-site scripting (XSS) attack via the `hostname` parameter at the "/cgi-bin/login.cgi" API endpoint. **Recommendations** As a temporary workaround, consider restricting access to the "/cgi-bin/login.cgi" API endpoint until a patch is available. Avoid using the `hostname` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.