Inateam

**Name of the Vulnerable Software and Affected Versions** Danneo CMS versions 0.5.1 and earlier **Description** The issue allows remote attackers to execute arbitrary SQL commands via the HTTP Referer header when the Referers statistics option is enabled. **Recommendations** For Danneo CMS versions 0.5.1 and earlier, consider disabling the Referers statistics option until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Neocrome Seditio CMS versions 121 and earlier **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `pag sub[]` parameter to "plug.php". **Recommendations** For Neocrome Seditio CMS versions 121 and earlier, update to a version later than 121 to resolve the issue. As a temporary workaround, consider restricting access to the "plug.php" endpoint to minimize the risk of exploitation. Avoid using the `pag sub[]` parameter in the affected endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Lussumo Vanilla versions 1.1.3 and earlier **Description** The issue allows remote attackers to conduct unauthorized sort operations and other activities on (1) "ajax/sortcategories.php" and (2) "ajax/sortroles.php" without requiring admin privileges. **Recommendations** For versions 1.1.3 and earlier, restrict access to the "ajax/sortcategories.php" and "ajax/sortroles.php" endpoints to require admin privileges, or update to a version where this issue is resolved, however, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Zomplog versions 3.8.1 and earlier Description: The issue allows remote attackers to download files uploaded by users due to insufficient access control. This can be achieved by obtaining a directory listing via a direct request to "/upload" and then retrieving individual files. In non-default configurations where directory listings are denied, filenames may still be predictable. Recommendations: For Zomplog versions 3.8.1 and earlier, consider restricting access to the "/upload" directory to prevent remote attackers from obtaining directory listings and retrieving individual files. As a temporary workaround, restrict access to the upload feature until a fix is available.

Name of the Vulnerable Software and Affected Versions: Shop-Script FREE versions 2.0 and earlier Description: The issue allows remote attackers to access the admin panel due to a failure to exit after sending a redirect to the web browser when administrative credentials are missing. Recommendations: For Shop-Script FREE versions 2.0 and earlier, update to a version later than 2.0 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Shop-Script FREE versions 2.0 and earlier Description: A direct static code injection issue allows remote attackers to inject arbitrary PHP code into cfg/appearence.inc.php via a save appearence action in "admin.php". The `productscount`, `colscount`, and `darkcolor` parameters are vulnerable to this injection. Recommendations: For Shop-Script FREE versions 2.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.