Fklov

**Name of the Vulnerable Software and Affected Versions** SourceCodester Onlne Examination & Learning Management System version 1.0 **Description** Improper authorization occurs in the Enrollment Management component within the `/ajax enroll.php` endpoint. A remote attacker can manipulate the `student id`, `schedule id`, and `action` variables to bypass authorization controls. **Recommendations** Restrict access to the `/ajax enroll.php` endpoint or avoid using the `student id`, `schedule id`, and `action` parameters until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Onlne Examination & Learning Management System version 1.0 **Description** An issue exists in the `/process lesson.php` file where manipulation of the `user id` variable allows for unrestricted file upload. This flaw can be exploited remotely. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Onlne Examination & Learning Management System version 1.0 **Description** An unrestricted upload flaw exists within the Filename Extension component. The issue resides in the `pathinfo()` function of the `/upload files.php` endpoint, where improper manipulation allows remote attackers to upload arbitrary files. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Onlne Examination & Learning Management System version 1.0 **Description** A weakness in the `/announcements.php` file allows for unrestricted file upload. This issue can be exploited remotely to upload unauthorized files to the server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** tiddly-gittly TidGi-Desktop versions prior to 0.13.1 **Description** A remote code injection issue exists within the Git Repository Import component. The flaw is located in the `src/services/wiki/wikiWorker/loadWikiTiddlersWithSubWikis.ts` file, where an unknown function fails to properly handle input, allowing an attacker to execute arbitrary code. **Recommendations** Update tiddly-gittly TidGi-Desktop to a version newer than 0.13.0. Restrict the use of the Git Repository Import component until the update is applied.

**Name of the Vulnerable Software and Affected Versions** jairiidriss restaurant-website-php-mysql versions up to 521428b5b612449df0cf4a5d15ee40cba67f3d35 **Description** A missing authentication flaw exists in the AJAX Endpoint component. A remote attacker can manipulate the '/admin/ajax files' endpoint to bypass authentication requirements. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the '/admin/ajax files' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** BeikeShop versions prior to 1.6.0.22 **Description** Improper authorization exists in the Stripe Plugin component. A remote attacker can manipulate the `Request` argument within the `callback()` function of the file 'plugins/Stripe/Controllers/StripeController.php' to bypass authorization controls. **Recommendations** Install patch 6719e0fc690ea0a998452092862e0f0a17c65968 for versions prior to 1.6.0.22. As a temporary workaround, restrict access to the `callback()` function in 'plugins/Stripe/Controllers/StripeController.php' to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Pizzafy E-Commerce System version 1.0 **Description** An SQL injection issue exists in the Administrative Control Panel component. The `Login()` function within the `/admin/admin class novo.php` file is susceptible to remote attacks through the manipulation of the `Username` argument. SQL injection is a technique where an attacker inserts malicious SQL code into a query, allowing them to interfere with the application's database. **Recommendations** Update SourceCodester Pizzafy E-Commerce System version 1.0 to a patched version. As a temporary workaround, restrict access to the `/admin/admin class novo.php` file or the `Login()` function until a fix is applied.