C_T_R_L

**Name of the Vulnerable Software and Affected Versions** The Motors – Car Dealer, Classifieds & Listing plugin for WordPress versions 1.4.43 and earlier **Description** The issue allows authenticated attackers with Subscriber-level access and above to execute arbitrary shortcodes due to the software permitting users to execute an action without properly validating a value before running `do shortcode`. This enables the execution of arbitrary shortcodes. **Recommendations** For versions 1.4.43 and earlier, update to a version later than 1.4.43 to resolve the issue. As a temporary workaround, consider restricting access to the `do shortcode` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Tailored Tools versions 1.8.4 and earlier **Description** The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting (XSS). This means that an attacker can inject malicious scripts into the website, potentially affecting users who access the compromised pages. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited. **Recommendations** For versions 1.8.4 and earlier, update to a version later than 1.8.4 to resolve the issue. As a temporary workaround, consider restricting user input to minimize the risk of exploitation. Avoid using potentially vulnerable API endpoints until the issue is resolved. At the moment, there is no additional information about other mitigation measures.

**Name of the Vulnerable Software and Affected Versions** Convert Docx2post versions n/a through 1.4 **Description** The issue allows an unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This can be exploited by uploading a malicious file to the server. **Recommendations** For versions n/a through 1.4, consider disabling the file upload feature until a patch is available to prevent the upload of malicious files. Restrict access to the file upload module to minimize the risk of exploitation. Avoid using the file upload feature in Convert Docx2post until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Subhasis Laha Gallerio versions n/a through 1.01 **Description** The issue allows an unrestricted upload of a file with a dangerous type, enabling the upload of a web shell to a web server. This can lead to potential security risks. **Recommendations** For Subhasis Laha Gallerio versions n/a through 1.01, consider disabling the file upload feature until a patch is available to prevent the upload of malicious files. Restrict access to the web server to minimize the risk of exploitation. Avoid using the vulnerable version of Gallerio until a fixed version is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Russell Albin Simple Business Manager versions n/a through 4.6.7.4 **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This problem allows for Stored XSS, where an attacker can inject malicious scripts into a website, which are then stored and executed by the website. The estimated number of potentially affected devices worldwide is not available. There is no information provided about real-world incidents where this issue was exploited. **Recommendations** For versions n/a through 4.6.7.4, update to a version that contains a fix for this issue, as the current version is affected by the Stored XSS vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Ajar in5 Embed versions 3.1.3 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, potentially enabling an attacker to upload a web shell to a web server. Recommendations: For versions 3.1.3 and earlier, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Myriad Solutionz Property Lot Management System versions n/a through 4.2.38 **Description** The issue allows hackers to upload malicious files, exploiting an Unrestricted File Upload vulnerability. This enables the upload of a web shell to a web server. **Recommendations** For versions n/a through 4.2.38, update to a version later than 4.2.38 to resolve the issue. As a temporary workaround, consider restricting file uploads to prevent malicious file uploads until a patch is available.