Cyberducky

**Name of the Vulnerable Software and Affected Versions** Asian Arts Talents Foundation (AATF) Website versions 5.1.x Asian Arts Talents Foundation (AATF) Docker version 2024.12.8.1 **Description** The Asian Arts Talents Foundation (AATF) Website and Docker image are susceptible to a Cross Site Scripting (XSS) issue. The `/ip.php` API endpoint processes the X-Forwarded-For HTTP header without sufficient sanitization or output encoding, enabling the injection of malicious JavaScript code into visitor browsers. **Recommendations** Asian Arts Talents Foundation (AATF) Website version 5.1.x: Sanitize and properly encode all user-supplied input, especially data received in HTTP headers, before displaying it in web pages. Asian Arts Talents Foundation (AATF) Docker version 2024.12.8.1: Sanitize and properly encode all user-supplied input, especially data received in HTTP headers, before displaying it in web pages.

**Name of the Vulnerable Software and Affected Versions** Many Notes version 0.10.1 **Description** Many Notes version 0.10.1 is susceptible to Cross Site Scripting (XSS). This allows malicious Markdown files to execute JavaScript when viewed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.