L8Bl

**Name of the Vulnerable Software and Affected Versions** LifePress versions through 2.1.3 **Description** A missing authorization issue exists in LifePress due to incorrectly configured access control security levels. This allows for potential exploitation. **Recommendations** Update LifePress to a version later than 2.1.3.

**Name of the Vulnerable Software and Affected Versions** Atheos versions prior to 6.0.4 **Description** Atheos is a self-hosted browser-based cloud integrated development environment. The improper use of `escapeshellcmd()` in `/components/codegit/traits/execute.php` allows argument injection, leading to arbitrary command execution. Administrators and users of vulnerable versions are at risk of data breaches or server compromise. Version 6.0.4 introduces a `Common::safe execute` function that sanitizes all arguments using `escapeshellarg()` prior to execution and migrated all components potentially vulnerable to similar exploits to use this new templated execution system. **Recommendations** Update to version 6.0.4 to resolve the issue. As a temporary workaround, consider restricting access to the `/components/codegit/traits/execute.php` endpoint until the update is applied. Avoid using the `escapeshellcmd()` function in sensitive operations until the `Common::safe execute` function is implemented.

**Name of the Vulnerable Software and Affected Versions** Easy Booked – Appointment Booking and Scheduling Management System for WordPress versions through 2.4.5 **Description** The issue is a Cross-Site Request Forgery (CSRF) vulnerability, which allows an attacker to perform unauthorized actions on a user's account. **Recommendations** For versions through 2.4.5, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WeGIA versions prior to 3.2.15 **Description** WeGIA is a Web manager for charitable institutions. An OS Command Injection issue was discovered, allowing an attacker to execute arbitrary code remotely via the `importar dump.php` endpoint. This could also enable a webshell upload. **Recommendations** For versions prior to 3.2.15, update to version 3.2.15 to apply the patch for the issue. As a temporary workaround, consider restricting access to the `importar dump.php` endpoint until the update can be applied.

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.13 Description: A SQL Injection issue was discovered in the WeGIA application, affecting the `documento excluir.php` endpoint. This could allow an attacker to execute arbitrary SQL queries, enabling unauthorized access to sensitive information. Recommendations: For versions prior to 3.2.13, upgrade to version 3.2.13 to resolve the issue. As a temporary workaround, consider restricting access to the `documento excluir.php` endpoint until the upgrade is applied.

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.13 Description: A SQL Injection issue was discovered in the WeGIA application, affecting the `dependente docdependente.php` endpoint. This could allow an attacker to execute arbitrary SQL queries, enabling unauthorized access to sensitive information. Recommendations: For versions prior to 3.2.13, upgrade to version 3.2.13 to address the issue. As a temporary workaround, consider restricting access to the `dependente docdependente.php` endpoint until the upgrade is applied.

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.14 Description: A SQL Injection vulnerability was discovered in the WeGIA application, `deletar documento.php` endpoint. This vulnerability allows an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive information. Recommendations: For versions prior to 3.2.14, upgrade to version 3.2.14 to address the issue. As a temporary workaround, consider restricting access to the `deletar documento.php` endpoint until the upgrade is applied. There are no known workarounds for this vulnerability.

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.14 Description: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. An OS Command Injection vulnerability was discovered in the WeGIA application, `gerenciar backup.php` endpoint. This vulnerability could allow an attacker to execute arbitrary code remotely. Recommendations: For versions prior to 3.2.14, upgrade to version 3.2.14 to address the issue. As a temporary workaround, consider restricting access to the `gerenciar backup.php` endpoint until the upgrade is applied. There are no known workarounds for this vulnerability.

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.13 Description: A SQL Injection vulnerability was discovered in the WeGIA application, `remover produto.php` endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthorized access to sensitive information. Recommendations: For versions prior to 3.2.13, upgrade to version 3.2.13 to address the issue. As a temporary workaround, consider restricting access to the `remover produto.php` endpoint until the upgrade is applied.

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.13 Description: A SQL Injection vulnerability was discovered in the WeGIA application, `restaurante produto desocultar.php` endpoint. This vulnerability allows an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive information. Recommendations: For versions prior to 3.2.13, upgrade to version 3.2.13 to address the SQL Injection vulnerability. As a temporary workaround, consider restricting access to the `restaurante produto desocultar.php` endpoint until the upgrade is applied.

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.14 Description: A SQL Injection vulnerability was discovered in the WeGIA application, `familiar docfamiliar.php` endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthorized access to sensitive information. Recommendations: For versions prior to 3.2.14, upgrade to version 3.2.14 to address the SQL Injection vulnerability. As a temporary workaround, consider restricting access to the `familiar docfamiliar.php` endpoint until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.14 Description: A Path Traversal vulnerability was discovered in the WeGIA application, affecting the `examples.php` endpoint. This issue could allow an attacker to gain unauthorized access to sensitive information stored in `config.php`, which contains data that could permit direct access to the database. Recommendations: For versions prior to 3.2.14, upgrade to version 3.2.14 to secure sensitive information stored in `config.php`. As a temporary workaround, consider restricting access to the `examples.php` endpoint until the upgrade is applied. Additionally, avoid using the `config.php` file in a way that could expose its contents until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.13 Description: A SQL Injection vulnerability was discovered in the WeGIA application, `deletar cargo.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive information. Recommendations: For WeGIA versions prior to 3.2.13, upgrade to version 3.2.13 to address the SQL Injection vulnerability. As a temporary workaround, consider restricting access to the `deletar cargo.php` endpoint until the upgrade is applied.

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.13 Description: A SQL Injection vulnerability was discovered in the WeGIA application, affecting the `informacao adicional.php` endpoint. This issue could allow an attacker to execute arbitrary SQL queries, resulting in unauthorized access to sensitive information. Recommendations: For versions prior to 3.2.13, upgrade to version 3.2.13 to resolve the issue. As a temporary workaround, consider restricting access to the `informacao adicional.php` endpoint until the upgrade is applied.

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.14 Description: A SQL Injection vulnerability was discovered in the WeGIA application, at the `historico paciente.php` endpoint. This issue could allow an attacker to execute arbitrary SQL queries, enabling unauthorized access to sensitive information. Recommendations: For versions prior to 3.2.14, upgrade to version 3.2.14 to address the SQL Injection vulnerability. As a temporary workaround, consider restricting access to the `historico paciente.php` endpoint until the upgrade is applied.

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.14 Description: A Path Traversal issue was discovered in the WeGIA application, affecting the `exportar dump.php` endpoint. This could allow an attacker to gain unauthorized access to sensitive information stored in `config.php`, which contains data that could enable direct access to the database. Recommendations: For versions prior to 3.2.14, upgrade to version 3.2.14 to address the issue. As a temporary workaround, consider restricting access to the `exportar dump.php` endpoint until the upgrade is applied. Additionally, restrict access to the `config.php` file to minimize the risk of exploitation. At the moment, there is no other information about additional mitigation measures.

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.13 Description: A SQL Injection vulnerability was discovered in the WeGIA application, `adicionar almoxarife.php` endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthorized access to sensitive information. Recommendations: For versions prior to 3.2.13, upgrade to version 3.2.13 to address the SQL Injection vulnerability in the `adicionar almoxarife.php` endpoint. As a temporary workaround, consider restricting access to the `adicionar almoxarife.php` endpoint until the upgrade is applied.

**Name of the Vulnerable Software and Affected Versions** DumpDrop (affected versions not specified) **Description** The issue is related to an OS Command Injection vulnerability in the DumpDrop application, specifically in the "/upload/init" endpoint. This vulnerability could allow an attacker to execute arbitrary code remotely when the Apprise Notification is enabled. There are no known workarounds for this issue. **Recommendations** As a temporary workaround, consider disabling the Apprise Notification feature until a patch is available. Restrict access to the "/upload/init" endpoint to minimize the risk of exploitation. Patch the vulnerability by applying the commit 4ff8469d.

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.12 Description: A SQL Injection vulnerability was discovered in the WeGIA application, `get detalhes cobranca.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information. Recommendations: For WeGIA versions prior to 3.2.12, upgrade to version 3.2.12 to address the SQL Injection vulnerability. As a temporary workaround, consider restricting access to the `get detalhes cobranca.php` endpoint until the upgrade is applied.

**Name of the Vulnerable Software and Affected Versions** WPGuppy versions 1.1.0 and earlier **Description** The issue is related to a lack of authorization in WPGuppy, allowing the exploitation of incorrectly configured access control security levels. **Recommendations** For versions 1.1.0 and earlier, update to a version that includes a fix for this issue, as no specific workaround is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.