Jinyitong

**Name of the Vulnerable Software and Affected Versions** topthink/framework versions prior to 6.0.12 **Description** The issue concerns Deserialization of Untrusted Data due to an insecure `unserialize` method in the `Driver` class. This allows for potential exploitation. **Recommendations** For versions prior to 6.0.12, update to version 6.0.12 or later to resolve the issue. As a temporary workaround, consider disabling the `unserialize` method in the `Driver` class until a patch is available. Restrict access to the `Driver` class to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** com.bstek.ureport:ureport2-console (affected versions not specified) **Description** The issue allows for Remote Code Execution by connecting to a malicious database server. This can cause arbitrary file read and deserialization of local gadgets. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Latte versions 2.8.0 through 2.8.7 Latte versions 2.9.0 through 2.9.5 Latte versions 2.10.0 through 2.10.7 **Description** Latte is an open source template engine for PHP. A sandbox escape exists in the template sandbox, allowing for injection into web pages generated from Latte, which may lead to XSS attacks. The issue affects users who use the sandbox in Latte and templates from untrusted sources. **Recommendations** For versions 2.8.0 through 2.8.7, update to version 2.8.8. For versions 2.9.0 through 2.9.5, update to version 2.9.6. For versions 2.10.0 through 2.10.7, update to version 2.10.8. As a temporary workaround for users unable to upgrade, do not accept template input from untrusted sources.

**Name of the Vulnerable Software and Affected Versions** codeception/codeception versions 4.0.0 through 4.1.21 codeception/codeception versions prior to 3.1.3 **Description** The issue affects systems that deserialize user input without validation, allowing the `RunProcess` class to be leveraged as a gadget to run arbitrary commands. **Recommendations** For versions 4.0.0 through 4.1.21, update to version 4.1.22 or later. For versions prior to 3.1.3, update to version 3.1.3 or later. As a temporary workaround, consider disabling the `RunProcess` class until a patch is available.