João Pedro S Alcântara

**Name of the Vulnerable Software and Affected Versions** LMS versions prior to 9.8 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, allowing an attacker to execute malicious scripts in the victim's browser without requiring authentication. **Recommendations** Update to a version newer than 9.7.

Unauthenticated Cross Site Scripting (XSS) in TheFox <= 3.9.76 versions.

**Name of the Vulnerable Software and Affected Versions** Automotive Car Dealership Business versions prior to 13.3.4 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, allowing an attacker to execute malicious scripts in the browser of a user without requiring authentication. **Recommendations** Update to a version newer than 13.3.3.

**Name of the Vulnerable Software and Affected Versions** Pearl - Corporate Business versions prior to 3.4.11 **Description** An unauthenticated Local File Inclusion (LFI) issue exists, which allows an attacker to read files from the local file system without requiring authentication. **Recommendations** Update Pearl - Corporate Business to a version newer than 3.4.10.

Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPress <= 5.2 versions.

**Name of the Vulnerable Software and Affected Versions** NativeChurch versions prior to 4.8.8.3 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, allowing attackers to execute malicious scripts without authentication. **Recommendations** Update NativeChurch to a version newer than 4.8.8.2.

Contributor PHP Object Injection in Werkstatt <= 4.8.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Automotive Listings <= 18.6 versions.

Unauthenticated Cross Site Scripting (XSS) in WPeMatico RSS Feed Fetcher <= 2.8.17 versions.

**Name of the Vulnerable Software and Affected Versions** Real Estate 7 versions prior to 3.5.10 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. **Recommendations** Update Real Estate 7 to version 3.5.10 or later.

**Name of the Vulnerable Software and Affected Versions** WofficeIO Woffice versions prior to 5.4.33 **Description** An issue exists where incorrectly configured access control security levels lead to missing authorization, allowing for potential exploitation. **Recommendations** Update WofficeIO Woffice to version 5.4.33 or later.

**Name of the Vulnerable Software and Affected Versions** Jobify versions prior to 4.3.3 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. **Recommendations** Update to a version newer than 4.3.2.

**Name of the Vulnerable Software and Affected Versions** Link Whisper Free versions prior to 0.9.5 **Description** Unauthenticated Cross Site Scripting (XSS) allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. **Recommendations** Update Link Whisper Free to version 0.9.5 or later.

Unauthenticated Cross Site Request Forgery (CSRF) in Real Estate 7 <= 3.5.9 versions.

**Name of the Vulnerable Software and Affected Versions** Neve PRO versions prior to 3.1.3 **Description** Cross Site Scripting (XSS) exists in the software, allowing users with contributor-level permissions to execute malicious scripts in the browser of other users. **Recommendations** Update Neve PRO to version 3.1.3 or later.

Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions.

Contributor Cross Site Scripting (XSS) in SeedProd Pro < 6.19.5 versions.

**Name of the Vulnerable Software and Affected Versions** Blog2Social versions prior to 8.9.3 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. **Recommendations** Update Blog2Social to version 8.9.3 or later.

**Name of the Vulnerable Software and Affected Versions** Master Slider versions prior to 3.11.3 **Description** An unauthenticated cross-site scripting (XSS) flaw exists in the web-facing input handling. The issue stems from improper input validation and output encoding, which allows attacker-supplied content to be rendered as an active script in the browser. A remote attacker can inject malicious payloads into exposed parameters or fields without authentication. If an administrator or user interacts with the crafted content, it can lead to session hijacking, admin account takeover via stolen cookies or nonces, and malicious redirects. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions.