Ngo Van Tu

**Name of the Vulnerable Software and Affected Versions** Dynamics 365 Customer Insights (affected versions not specified) **Description** The issue is related to the failure to properly secure the web page structure in Microsoft Dynamics 365 Customer Insights, allowing a remote attacker to conduct spoofing attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dynamics 365 Field Service (affected versions not specified) **Description** The issue concerns a spoofing vulnerability. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Dynamics 365 (affected versions not specified) **Description** The issue is related to errors in the representation of information by the user interface, which can be exploited by a remote attacker to conduct spoofing attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Dynamics 365 Sales (affected versions not specified) **Description** The issue is related to errors in the representation of information by the user interface of the Microsoft Dynamics 365 server. It may allow a remote attacker to conduct cross-site scripting attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AI ChatBot WordPress plugin versions prior to 4.6.1 **Description** The issue allows high-privilege users, such as admins, to perform Cross-Site Scripting attacks. This is possible because the plugin does not adequately escape some settings, even when the unfiltered html capability is disallowed. **Recommendations** For AI ChatBot WordPress plugin versions prior to 4.6.1, update to version 4.6.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Book Store Management System version 1.0 **Description** The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability is located in the `/bsms ci/index.php/book` endpoint and allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `publisher` parameter. **Recommendations** For Book Store Management System version 1.0, consider disabling access to the `/bsms ci/index.php/book` endpoint until a patch is available. As a temporary workaround, restrict the use of the `publisher` parameter in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Human Resource Management System version 1.0 **Description** A problematic issue has been discovered, affecting an unknown function of the file /hrm/employeeview.php. The manipulation of the `search` argument leads to cross-site scripting. This issue can be exploited remotely. **Recommendations** For version 1.0, consider disabling the `search` argument in the /hrm/employeeview.php file as a temporary workaround until a patch is available. Restrict access to the /hrm/employeeview.php file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Human Resource Management System version 1.0 SourceCodester Book Store Management System version 1.0 **Description** A critical issue affects the processing of the file /hrm/employeeadd.php, where the manipulation of the `empid` argument leads to SQL injection. The attack can be initiated remotely. **Recommendations** For SourceCodester Human Resource Management System version 1.0, consider disabling the /hrm/employeeadd.php file until a patch is available. For SourceCodester Book Store Management System version 1.0, restrict access to the /hrm/employeeadd.php file to minimize the risk of exploitation. Avoid using the `empid` argument in the affected file until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Human Resource Management System version 1.0 **Description** A critical issue has been found in the Content-Type Handler component, specifically affecting the /hrm/controller/employee.php file. The manipulation of the `pfimg` argument leads to unrestricted upload. This issue can be exploited remotely. **Recommendations** For SourceCodester Human Resource Management System version 1.0, consider disabling the file upload functionality in the /hrm/controller/employee.php file until a patch is available. Restrict access to the Content-Type Handler component to minimize the risk of exploitation. Avoid using the `pfimg` argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Book Store Management System version 1.0 **Description** A problematic vulnerability has been found in the SourceCodester Book Store Management System. This issue affects an unknown part of the file `/bsms ci/index.php/user/edit user/` and allows for information disclosure through the manipulation of the `password` argument. The attack can be initiated remotely. **Recommendations** For SourceCodester Book Store Management System version 1.0, consider disabling the `/bsms ci/index.php/user/edit user/` endpoint until a patch is available to prevent exploitation. Restrict access to the `password` argument in the affected endpoint to minimize the risk of information disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tribal Systems Zenario CMS version 9.3.57595 **Description** The issue affects the Remember Me Handler component, leading to session fixation. This can be exploited remotely, and the exploit has been disclosed. The attack may be initiated by an attacker setting up a trap session on the device the victim is likely to login with, taking advantage of the fact that the user session identifier is not changed after user logout and login again when the "Remember me" option is active. **Recommendations** For version 9.3.57595, consider disabling the "Remember me" option as a temporary workaround to minimize the risk of session fixation until a patch is available. Restrict access to the Remember Me Handler component to prevent potential exploitation.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Book Store Management System version 1.0 **Description** A critical vulnerability was found in the SourceCodester Book Store Management System, affecting unknown code of the file /bsms ci/index.php. This issue leads to improper access controls and can be initiated remotely. The exploit has been disclosed to the public. **Recommendations** As a temporary workaround, consider restricting access to the /bsms ci/index.php file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.