Ivan Glinkin

**Name of the Vulnerable Software and Affected Versions** Vaales Technologies V QRS version 2024-01-17 **Description** The issue allows a remote attacker to obtain sensitive information via the Models/UserModel.php component. This is achieved through a SQL injection vulnerability. **Recommendations** For Vaales Technologies V QRS version 2024-01-17, consider restricting access to the Models/UserModel.php component until a patch is available. As a temporary workaround, avoid using user-supplied input in SQL queries to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Vaales Technologies V QRS version 2024-01-17 **Description** The issue allows a remote attacker to obtain sensitive information via the Models/FormModel.php and QRModel.php component. **Recommendations** For Vaales Technologies V QRS version 2024-01-17, consider restricting access to the Models/FormModel.php and QRModel.php components until a patch is available. As a temporary workaround, avoid using these components to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.