Baihekuz

**Name of the Vulnerable Software and Affected Versions** technical-laohu mpay versions up to 1.2.4 **Description** A flaw exists in the User Center component of technical-laohu mpay. Manipulation of the `Nickname` argument within an unknown function can lead to cross site scripting. The exploit is publicly available and could be used for attacks. **Recommendations** Versions prior to 1.2.4 should be updated.

**Name of the Vulnerable Software and Affected Versions** technical-laohu mpay versions up to 1.2.4 **Description** A cross-site request forgery condition exists in technical-laohu mpay. Exploitation of this issue involves manipulation of an unknown function and may allow for remote attacks. The exploit is publicly available. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** technical-laohu mpay versions up to 1.2.4 **Description** A security issue exists in the QR Code Image Handler component of technical-laohu mpay. Manipulation of the `codeimg` argument can lead to unrestricted upload. This issue can be exploited remotely. The exploit has been publicly disclosed. **Recommendations** Update technical-laohu mpay to a version later than 1.2.4.

**Name of the Vulnerable Software and Affected Versions** Tmall Demo up to 20250505 **Description** A critical vulnerability was found in Tmall Demo, affecting the `uploadCategoryImage` function of the file `tmall/admin/uploadCategoryImage`. The manipulation of the `File` argument leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. **Recommendations** As a temporary workaround, consider disabling the `uploadCategoryImage` function until a fix is available. Restrict access to the `tmall/admin/uploadCategoryImage` file to minimize the risk of exploitation. Avoid using the `File` argument in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tmall Demo up to 20250505 **Description** A critical issue was found in Tmall Demo, affecting the `uploadProductImage` function of the file `tmall/admin/uploadProductImage`. The manipulation of the `File` argument leads to unrestricted upload. This issue can be exploited remotely. The exploit has been disclosed publicly. **Recommendations** For Tmall Demo up to 20250505, as a temporary workaround, consider disabling the `uploadProductImage` function until a fix is available. Restrict access to the `tmall/admin/uploadProductImage` file to minimize the risk of exploitation. Avoid using the `File` argument in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Tmall Demo up to 20250505 **Description** A vulnerability was found in the processing of the file `tmall/admin/account/logout`, which leads to cross-site request forgery. The attack may be initiated remotely. The issue affects some unknown processing, and the exploit has been disclosed to the public. **Recommendations** As a temporary workaround, consider disabling the logout processing endpoint until a fix is available. Restrict access to the `tmall/admin/account/logout` file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tmall Demo up to 20250505 **Description** A vulnerability has been found in the Search Box component of Tmall Demo, allowing for cross-site scripting through remote attack. The manipulation of an unknown function leads to this issue. The vendor was contacted about this disclosure but did not respond. The estimated number of potentially affected devices worldwide is not available. **Recommendations** As a temporary workaround, consider restricting access to the Search Box component until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tmall Demo up to 20250505 **Description** A problematic vulnerability was found in the Buy Item Page component of Tmall Demo, allowing for cross-site scripting through the manipulation of the `Detailed Address` argument. This issue can be exploited remotely. The vendor was contacted about this disclosure but did not respond. **Recommendations** For Tmall Demo up to 20250505, as a temporary workaround, consider restricting the use of the `Detailed Address` argument in the Buy Item Page to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tmall Demo up to 20250505 **Description** A problematic issue has been found in the Product Details Page component of Tmall Demo, affecting some unknown functionality of the file /tmall/admin/. The manipulation of the `Product Name`/`Product Title` argument leads to cross-site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. **Recommendations** As a temporary workaround, consider restricting the use of the `Product Name`/`Product Title` argument in the Product Details Page until a fix is available. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Tmall Demo up to 20250505 **Description** A vulnerability was found in Tmall Demo, affecting an unknown part of the file `/tmall/order/pay/` of the component Payment Identifier Handler. The manipulation leads to insufficiently random values. It is possible to initiate the attack remotely. The complexity of an attack is rather high, and the exploitability is difficult. The exploit has been disclosed to the public and may be used. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MRCMS version 3.1.2 **Description** A vulnerability was found in MRCMS, classified as problematic, affecting an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Multiple endpoints might be affected. **Recommendations** As a temporary workaround, consider restricting access to all API endpoints until a patch is available. Avoid using any functionality that may be related to the unknown affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MRCMS version 3.1.2 **Description** A vulnerability has been found in the Category Management Page component, affecting unknown code of the file /admin/category/add.do. The manipulation of the `Name` argument leads to cross-site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For MRCMS version 3.1.2, consider disabling access to the /admin/category/add.do file until a patch is available. As a temporary workaround, restrict the manipulation of the `Name` argument in the Category Management Page to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** MRCMS version 3.1.2 **Description** A vulnerability was found in the processing of the file "/admin/chip/add.do" of the component "Add Fragment Page". This issue leads to cross-site scripting and can be initiated remotely. The manipulation of this file can cause the vulnerability to be exploited. **Recommendations** For MRCMS version 3.1.2, consider restricting access to the "/admin/chip/add.do" endpoint until a patch is available. As a temporary workaround, avoid using the Add Fragment Page component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** MRCMS version 3.1.2 **Description** A problematic issue was found in the External Link Management Page component, affecting an unknown part of the file /admin/link/edit.do. This issue leads to cross site scripting and can be initiated remotely. The exploit has been disclosed to the public. **Recommendations** For MRCMS version 3.1.2, consider restricting access to the /admin/link/edit.do endpoint until a patch is available. As a temporary workaround, avoid using the External Link Management Page component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** MRCMS version 3.1.2 **Description** A problematic issue has been found in the Edit Article Page component. The manipulation of the `Title` argument leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For MRCMS version 3.1.2, consider restricting the use of the Edit Article Page component until a patch is available. As a temporary workaround, avoid using the `Title` argument in the affected component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MRCMS version 3.1.3 **Description** A vulnerability was found in the Group Edit Page component, specifically affecting some unknown functionality of the file /admin/group/edit.do. This issue leads to cross-site scripting and can be exploited remotely. **Recommendations** For MRCMS version 3.1.3, consider restricting access to the /admin/group/edit.do file until a patch is available. As a temporary workaround, avoid using the Group Edit Page component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** MRCMS version 3.1.3 ASUS router (affected versions not specified) **Description** A vulnerability has been found that allows for cross-site scripting through the manipulation of the `Username` argument in the file /admin/user/edit.do of the Edit User Page component. The attack can be launched remotely. Additionally, a flaw in ASUS routers, when AiCloud is enabled, can allow hackers to access the network from a distance, potentially leading to spying or network disruption. **Recommendations** For MRCMS version 3.1.3, consider disabling the Edit User Page component or restricting access to the /admin/user/edit.do file until a patch is available. For ASUS routers, disable AiCloud to minimize the risk of exploitation. Avoid using the `Username` argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.