Fkalis

**Name of the Vulnerable Software and Affected Versions** Dreamer CMS versions up to 4.1.3 **Description** A vulnerability was found in the file /upload/ueditorConfig?action=config, affecting an unknown function. The manipulation leads to files or directories being made accessible. It is possible to launch the attack remotely. The complexity of an attack is rather high, and the exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. **Recommendations** For versions up to 4.1.3, as a temporary workaround, consider restricting access to the /upload/ueditorConfig?action=config file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mini-Tmall versions up to 20230811 **Description** A critical issue has been found, affecting some unknown functionality of the file product/1/1?test=1&test2=2&, allowing for SQL injection through the manipulation of the `orderBy` argument. This issue can be exploited remotely. **Recommendations** For Mini-Tmall versions up to 20230811, as a temporary workaround, consider restricting access to the `orderBy` argument in the affected file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.