Manas Bellani

**Name of the Vulnerable Software and Affected Versions** Ivan Cordoba Generic Content Management System (CMS) through 2018-04-28 **Description** The issue concerns a Cross-Site Scripting (XSS) flaw. It is exploitable via the Administrator/add pictures.php `article ID`. **Recommendations** For Ivan Cordoba Generic Content Management System (CMS) through 2018-04-28, update to a version released after 2018-04-28 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Ivan Cordoba Generic Content Management System (CMS) through 2018-04-28 **Description** The issue allows for XSS via the Administrator/users.php `user ID`. **Recommendations** For Ivan Cordoba Generic Content Management System (CMS) through 2018-04-28, avoid using the `user ID` in the Administrator/users.php endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Ivan Cordoba Generic Content Management System (CMS) versions prior to 2018-04-28 **Description** The issue allows for SQL injection, which can be used for authentication bypass. This means an attacker could potentially gain unauthorized access to the system without proper credentials. **Recommendations** For versions prior to 2018-04-28, update to a version released after 2018-04-28 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Ivan Cordoba Generic Content Management System (CMS) versions through 2018-04-28 **Description** The issue allows for SQL injection, which can be used for authentication bypass. This means an attacker could potentially gain unauthorized access to the system without proper credentials. **Recommendations** For Ivan Cordoba Generic Content Management System (CMS) versions through 2018-04-28, consider restricting access to the `user/index.php` file until a fix is available. As a temporary workaround, review and modify the SQL queries to prevent injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.