Benjamin Mosse

**Name of the Vulnerable Software and Affected Versions** KLF-REALTY (affected versions not specified) **Description** The issue concerns SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. This is achieved through the `category` and `agent` parameters in the "search listing.asp" endpoint, and the `property id` parameter in the "detail.asp" endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** vSpin.net Classified System 2004 **Description** The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters in two different ASP files: - The `cat` parameter to "cat.asp", - The `keyword`, `order`, `sort`, `menuSelect`, or `state` parameters to "search.asp". **Recommendations** For vSpin.net Classified System 2004, consider restricting access to the "cat.asp" and "search.asp" files until a patch is available. As a temporary workaround, avoid using the `cat`, `keyword`, `order`, `sort`, `menuSelect`, and `state` parameters in the respective API endpoints. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** vSpin.net Classified System 2004 **Description** The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the vulnerabilities can be exploited through the `catname` parameter to "cat.asp" or the `minprice` parameter to "search.asp". **Recommendations** For vSpin.net Classified System 2004, consider restricting access to the `catname` parameter in "cat.asp" and the `minprice` parameter in "search.asp" to minimize the risk of exploitation. Avoid using these parameters until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.