Jkoreamo

**Name of the Vulnerable Software and Affected Versions** Gladinet CentreStack version 13.12.9934.54690 **Description** The issue allows attackers to access sensitive data or execute arbitrary commands via a crafted payload injected into the `username` field in the login page. **Recommendations** For Gladinet CentreStack version 13.12.9934.54690, consider temporarily restricting access to the login page until a patch is available. Avoid using the `username` field in the affected login endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gladinet CentreStack version 13.12.9934.54690 **Description** A reflected cross-site scripting (XSS) issue allows attackers to inject malicious JavaScript into a victim's web browser via the `sessionId` parameter at the "/portal/ForgotPassword.aspx" API endpoint. This can lead to unauthorized access to sensitive information. **Recommendations** For Gladinet CentreStack version 13.12.9934.54690, consider restricting access to the "/portal/ForgotPassword.aspx" endpoint until a patch is available, and avoid using the `sessionId` parameter in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.