Mike Manzotti

**Name of the Vulnerable Software and Affected Versions** Pro Chat Rooms Text Chat Rooms version 8.2.0 **Description** The issue allows remote authenticated users to inject arbitrary web script or HTML, which can lead to cross-site scripting (XSS) attacks. This can be achieved via two methods: (1) uploading a malicious profile picture or (2) manipulating the `edit` parameter in the `profiles/index.php` API endpoint. **Recommendations** For Pro Chat Rooms Text Chat Rooms version 8.2.0, consider disabling the profile picture upload feature and restricting access to the `profiles/index.php` endpoint until a patch is available. Avoid using the `edit` parameter in the `profiles/index.php` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Sphider version 1.3.6 **Description** A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `filter` parameter in the "admin/admin.php" endpoint. **Recommendations** For Sphider version 1.3.6, avoid using the `filter` parameter in the "admin/admin.php" endpoint until a patch is available. As a temporary workaround, consider restricting access to the "admin/admin.php" endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Sphider version 1.3.6 **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `category` parameter in the admin/admin.php file. **Recommendations** For Sphider version 1.3.6, consider restricting access to the `category` parameter in the admin/admin.php file until a patch is available. Avoid using the `category` parameter in the affected endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Sphider version 1.3.6 **Description** A static code injection issue allows remote authenticated users to inject arbitrary PHP code into settings/conf.php via the ` word upper bound` parameter in admin/admin.php. **Recommendations** For Sphider version 1.3.6, avoid using the ` word upper bound` parameter in the admin/admin.php file until a patch is available. As a temporary workaround, consider restricting access to the admin/admin.php file to minimize the risk of exploitation.