Kamil Szczurowski

**Name of the Vulnerable Software and Affected Versions** PHP Jabbers - PHP Poll Script versions prior to 4.1 **Description** A reflected cross-site scripting (XSS) issue allows an attacker to execute arbitrary JavaScript in a user's browser by inducing them to open a specially crafted URL. **Recommendations** Update to version 4.1.

**Name of the Vulnerable Software and Affected Versions** PHP Jabbers scripts (affected versions not specified) **Description** A Cross-Site Request Forgery (CSRF) issue exists due to the absence of CSRF tokens or appropriate SameSite attributes. This allows an attacker to send unauthorized requests using the session of an authenticated user, which can result in unauthorized administrative actions, including the creation of new admin accounts. CSRF is a technique where a malicious website causes a user's web browser to perform an unwanted action on a different website where the user is currently authenticated. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PHP Jabbers - PHP Poll Script versions prior to 4.1 **Description** An authenticated attacker can perform SQL Injection attacks due to improper neutralization of user input sent to the 'pjAdminPolls.controller.php' endpoint. SQL Injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** Update to version 4.1.

**Name of the Vulnerable Software and Affected Versions** PHP Jabbers scripts (affected versions not specified) **Description** An authenticated SQL injection occurs due to improper neutralization of input provided by a user into parameters used for sorting functions. This allows an authenticated attacker to execute arbitrary SQL commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PHP Jabbers - Car Rental Script versions prior to 4.1 **Description** Improper neutralization of user-provided input in parameters used for sorting functions allows an unauthenticated attacker to execute SQL Injection attacks. SQL Injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** Update to version 4.1.

**Name of the Vulnerable Software and Affected Versions** ThemisNETPanel (affected versions not specified) **Description** A Remote Code Execution issue exists due to missing authentication for a critical file upload function. The application exposes an endpoint that allows unauthenticated attackers to upload arbitrary PHP files by providing a base64-encoded payload, enabling the execution of arbitrary code on the underlying server. **Recommendations** Apply the patch released in April 2026.

**Name of the Vulnerable Software and Affected Versions** UBB.threads version 7.7.5 **Description** An authenticated attacker can cause a Denial of Service (DoS) by sending multiple concurrent requests to view user profiles. On instances with a large number of registered users, this action exhausts database resources, resulting in a complete loss of application access for other users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** UBB.threads version 7.7.5 **Description** Path traversal allows attackers with privileges to edit templates to read and write any file on the application server that the application has permissions to access. This can lead to Remote Code Execution, which is the ability to execute arbitrary commands on the target machine. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** uBB.threads version 7.7.5 **Description** Lack of protective mechanisms leads to a Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks an authenticated user into performing unintended actions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** UBB.threads version 7.7.5 **Description** Reflected Cross-Site Scripting (XSS) occurs when the application improperly handles user input in certain requests. This allows attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** UBB.threads version 7.7.5 **Description** Insufficient input sanitization in the Members in Control Panel allows attackers to interact with the underlying database via Blind SQL Injection. This technique involves sending queries that the database answers with a boolean (true/false) or a time delay, enabling the extraction of sensitive information such as user credentials. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** UBB.threads version 7.7.5 **Description** Stored Cross-Site Scripting occurs because the application fails to properly sanitize user input in user posts and user profile fields. This allows low privileged attackers to inject arbitrary JavaScript that executes in a victim's browser when the content is viewed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Responsive FileManager version 9.14.0 **Description** An unauthenticated attacker can upload files of any type and extension without restriction via the 'dialog.php' endpoint. This unrestricted file upload can lead to Remote Code Execution, which allows an attacker to execute arbitrary code on the server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Some increased actor activities are shown targeting BinSoft mpGabinet (CVE-2026-40552) https://t.co/mUbccZwq7B

**Name of the Vulnerable Software and Affected Versions** mpGabinet versions prior to 23.12.20 **Description** Privilege Escalation occurs due to excessive database privileges assigned to the application user. An attacker with access to a running application instance connected to the backend server can extract database credentials from the application's memory by inspecting the running process. These exposed credentials provide administrative access to the database, allowing actions that exceed the privileges required for normal application functionality and those permitted through the application interface. **Recommendations** Update to a version later than 23.12.19.

**Name of the Vulnerable Software and Affected Versions** mpGabinet versions prior to 23.12.20 **Description** mpGabinet performs client-side authentication, which is a process where the verification of user credentials happens on the user's device rather than the server. An attacker with access to any application instance connected to the backend server can bypass the login verification process by manipulating the application binary to authenticate as an arbitrary user. **Recommendations** Update to a version later than 23.12.19.

**Name of the Vulnerable Software and Affected Versions** LatePoint – Calendar Booking Plugin for Appointments and Events versions through 5.1.94 **Description** The LatePoint – Calendar Booking Plugin for Appointments and Events for WordPress is susceptible to Stored Cross-Site Scripting. The issue stems from inadequate input sanitization and output escaping in the `service[name]` parameter. This allows authenticated attackers with administrator-level access to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. This only affects multi-site installations and installations where unfiltered html has been disabled. **Recommendations** Update LatePoint – Calendar Booking Plugin for Appointments and Events to a version later than 5.1.94.

**Name of the Vulnerable Software and Affected Versions** PAD CMS (affected versions not specified) **Description** The file upload functionality in PAD CMS allows an unauthenticated remote attacker to upload files of any type and extension without restriction. This is due to a client-controlled permission check parameter. Successful exploitation can lead to Remote Code Execution. The issue affects all three templates: www, bip, and ww+bip. The product is End-Of-Life and the producer will not publish patches for this vulnerability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PAD CMS (affected versions not specified) **Description** The software’s photo upload functionality allows a remote attacker to upload files of any type and extension without restriction due to a client-controlled permission check parameter. This can lead to Remote Code Execution. The issue affects all three templates: `www`, `bip`, and `ww+bip`. The product is End-Of-Life and the producer will not release patches for this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GOV CMS versions prior to 4.0 **Description** The input from the search query parameter in GOV CMS is not properly sanitized, leading to a Blind SQL injection. This could be exploited by an unauthenticated remote attacker. **Recommendations** Ensure proper sanitization of input from the search query parameter.