Marcela Benetrix

Name of the Vulnerable Software and Affected Versions: Dokeos version 2.1.1 Description: The issue involves multiple XSS problems related to `extra ` parameters in the `main/auth/profile.php` file. This could potentially allow attackers to execute malicious scripts. Recommendations: For Dokeos version 2.1.1, consider restricting access to the `main/auth/profile.php` file or disabling the use of `extra ` parameters until a fix is available. Avoid using the `extra ` parameters in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Horde Groupware Webmail Edition versions 5.1.2 and earlier **Description** The issue concerns multiple CSRF problems. **Recommendations** For versions 5.1.2 and earlier, update to a version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** AJAX Post Search (cardoza-ajax-search) plugin versions prior to 1.3 **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the `srch txt` parameter in a "the search text" action to the `/wp-admin/admin-ajax.php` API endpoint, specifically targeting the `the search function` function in `cardoza ajax search.php`. **Recommendations** For versions prior to 1.3, update to version 1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the `the search function` function in `cardoza ajax search.php` until the update is applied. Avoid using the `srch txt` parameter in the affected API endpoint until the issue is resolved.