Lavon321

**Name of the Vulnerable Software and Affected Versions** DWSurvey version 3.2.0 **Description** A remote command execution issue was discovered in DWSurvey via the component /sysuser/SysPropertyAction.java. This allows for potential remote command execution. **Recommendations** For DWSurvey version 3.2.0, consider restricting access to the /sysuser/SysPropertyAction.java component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DWSurvey version 3.2.0 **Description** The issue is related to an arbitrary file write vulnerability. It affects the component `/utils/ToHtmlServlet.java`. **Recommendations** For DWSurvey version 3.2.0, consider restricting access to the `/utils/ToHtmlServlet.java` component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** ShopXO version 1.9.0 **Description** The issue allows attackers to execute arbitrary code via uploading a crafted PHP file, exploiting an arbitrary file upload vulnerability in the upload payment plugin. **Recommendations** For ShopXO version 1.9.0, consider disabling the upload payment plugin until a patch is available to prevent arbitrary file uploads and subsequent code execution.

**Name of the Vulnerable Software and Affected Versions** ShopXO version 1.9.0 **Description** The issue concerns an arbitrary file upload vulnerability in the PluginsUpload function, located in application/service/PluginsAdminService.php. This vulnerability allows attackers to execute arbitrary code by uploading a crafted PHP file. **Recommendations** For ShopXO version 1.9.0, consider disabling the PluginsUpload function in application/service/PluginsAdminService.php until a patch is available to prevent arbitrary file uploads. Restrict access to the vulnerable function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.