Chunhao Yang

**Name of the Vulnerable Software and Affected Versions** AgentFlow (affected versions not specified) **Description** AgentFlow developed by Flowring has a Stored Cross-Site Scripting issue. Authenticated remote attackers can inject persistent JavaScript code that executes in users' browsers when a page loads. The issue allows for the injection of malicious scripts, potentially compromising user accounts or data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Docpedia (affected versions not specified) **Description** Docpedia, developed by Flowring, exhibits a SQL Injection issue. This allows attackers who do not need to log in to inject and execute arbitrary SQL commands, potentially leading to unauthorized access to database contents. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Docpedia (affected versions not specified) **Description** Docpedia developed by Flowring has a SQL Injection issue. Authenticated remote attackers can inject arbitrary SQL commands, potentially allowing them to read, modify, and delete database contents. The vulnerability allows for unauthorized database manipulation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AgentFlow (affected versions not specified) **Description** AgentFlow developed by Flowring has a Reflected Cross-site Scripting issue. This allows unauthenticated remote attackers to execute arbitrary JavaScript code in a user's browser through phishing attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Orca HCM from LEARNING DIGITAL (affected versions not specified) Description: The issue is related to a missing authentication vulnerability, allowing an unauthenticated remote attacker to exploit the functionality and create an account with administrator privileges, subsequently using it to log in. This vulnerability enables unauthorized access, risking administrator account creation and access by remote attackers. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Orca HCM from LEARNING DIGITA versions up to 10.x Description: The issue is related to the file download functionality, where a specific parameter is not properly restricted. This allows a remote attacker with regular privileges to download arbitrary system files. The estimated number of potentially affected devices is not provided. There is no information about real-world incidents where this issue was exploited. The vulnerability is related to a path traversal issue in the File Download Handler. Recommendations: For Orca HCM from LEARNING DIGITA versions up to 10.x: Upgrade the affected component immediately to mitigate the risk. As a temporary workaround, consider restricting access to the file download functionality until a patch is available. Avoid using the vulnerable file download parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ArmorX Android APP (affected versions not specified) **Description** The ArmorX Android APP's multi-factor authentication (MFA) for the login function is not properly implemented. Remote attackers who obtain user credentials can bypass MFA, allowing them to successfully log into the APP. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Network camera device (affected versions not specified) **Description** The issue concerns the manage users profile services of the network camera device, which allows an authenticated remote attacker to modify URL parameters and amend a user's information. This can lead to privilege escalation, enabling the attacker to control the devices. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.