Mkucej

**Name of the Vulnerable Software and Affected Versions** mkucej/i-librarian-free versions prior to 5.10.4 **Description** The issue is related to Cross-site Scripting (XSS) - Reflected. This means an attacker can inject malicious scripts into a website, which will be executed by the user's browser. No information is provided about the estimated number of potentially affected devices or real-world incidents. **Recommendations** For versions prior to 5.10.4, update to version 5.10.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** mkucej/i-librarian-free versions prior to 5.10.4 **Description** The issue is related to Cross-site Scripting (XSS) - Stored. This means that an attacker can inject malicious scripts into the application, which are then stored and executed by the application, potentially allowing the attacker to steal user data or take control of user sessions. **Recommendations** For versions prior to 5.10.4, update to version 5.10.4 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: I, Librarian versions 4.8 and earlier Description: The issue is related to a Cross Site Request Forgery (CSRF) vulnerability. This vulnerability is located in the users.php file and can lead to the admin's password being changed without their knowledge. Recommendations: For versions 4.8 and earlier, update to a version that contains a fix for this issue to prevent unauthorized password changes. As a temporary workaround, consider restricting access to the users.php file to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: I, Librarian versions 4.8 and earlier Description: The issue concerns a Cross Site Scripting (XSS) vulnerability. This vulnerability is located in the `id` parameter of the stable.php file. It allows an attacker to send a malicious script to an unsuspecting user. Recommendations: For I, Librarian versions 4.8 and earlier, as a temporary workaround, consider restricting access to the `id` parameter in the stable.php file until a patch is available. Avoid using the `id` parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.