Komorebi

**Name of the Vulnerable Software and Affected Versions** IbuyuCMS versions up to 2.6.3 **Description** A vulnerability exists in IbuyuCMS that allows for cross site scripting. The issue is located in the Add Article Page component, specifically within the file `/admin/article.php?a=mod`. Manipulation of the `Title` argument can trigger the vulnerability. The exploit is publicly available. **Recommendations** Update IbuyuCMS to a version later than 2.6.3.

**Name of the Vulnerable Software and Affected Versions** Xianqi Kindergarten Management System version 2.0 Bulid 20190808 **Description** A critical issue affects the unknown processing of the file `stu list.php` of the component Child Management. The manipulation of the argument `sex` leads to SQL injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. **Recommendations** As a temporary workaround, consider disabling the `stu list.php` file or restricting access to it until a patch is available. Avoid using the `sex` argument in the affected component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Maybecms version 1.2 **Description** A problematic issue has been found in Maybecms, affecting an unknown part of the file /mb/admin/index.php?u=article-edit of the component Add Article. The manipulation of the `data info[content]` argument leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For Maybecms version 1.2, as a temporary workaround, consider restricting access to the /mb/admin/index.php?u=article-edit endpoint until a patch is available. Avoid using the `data info[content]` argument in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SEMCMS versions prior to 4.8 **Description** A critical issue has been found in SEMCMS, affecting an unknown functionality of the SEMCMS Images.php file in the Image Library Management Page component. This issue leads to a SQL injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. **Recommendations** For versions prior to 4.8, as a temporary workaround, consider disabling the `SEMCMS Images.php` file or restricting access to the Image Library Management Page until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sucms version 1.0 **Description** A critical issue affects some unknown functionality of the file /admin/admin members.php?ac=search. The manipulation of the `uid` argument leads to SQL injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For Sucms version 1.0, as a temporary workaround, consider restricting access to the `/admin/admin members.php?ac=search` endpoint until a patch is available. Avoid using the `uid` argument in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sucms version 1.0 **Description** A problematic issue has been found, affecting some unknown functionality of the file "admin ads.php?action=add". The manipulation of the `intro` argument leads to cross site scripting. The attack may be launched remotely. **Recommendations** For Sucms version 1.0, as a temporary workaround, consider restricting access to the "admin ads.php?action=add" endpoint until a patch is available. Avoid using the `intro` argument in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.