Okan Kurtuluş

**Name of the Vulnerable Software and Affected Versions** X2CRM version 8.5 **Description** The issue is a stored Cross-Site Scripting (XSS) in the "Opportunities" module. An attacker can inject malicious JavaScript code into the `Name` field when creating a list. **Recommendations** For X2CRM version 8.5, as a temporary workaround, consider restricting access to the "Opportunities" module to minimize the risk of exploitation. Avoid using the `Name` field in the affected module until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Vtiger CRM version 8.2.0 **Description** The issue is related to a HTML Injection vulnerability in the `module` parameter. This allows authenticated users to inject arbitrary HTML. **Recommendations** For Vtiger CRM version 8.2.0, consider restricting access to the `module` parameter to prevent HTML injection until a patch is available.

**Name of the Vulnerable Software and Affected Versions** October CMS version 3.4.4 **Description** The issue allows attackers to execute arbitrary code via a crafted file, specifically an svg file, which can be uploaded to the system. This can be done in the context of a browser and requires the attacker to be authenticated as a user. **Recommendations** For October CMS version 3.4.4, consider disabling the file upload feature, especially for svg files, until a patch is available to prevent arbitrary code execution. Restrict access to the file upload module to minimize the risk of exploitation. Avoid using the file upload functionality with untrusted files or sources until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** CMS Made Simple version 2.2.17 **Description** A Cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the File Upload function. **Recommendations** For CMS Made Simple version 2.2.17, update to a version that fixes this issue to prevent exploitation.

**Name of the Vulnerable Software and Affected Versions** Food Ordering System version 1.0 **Description** A SQL Injection issue allows attackers to execute commands on the database by sending crafted SQL queries to the `ID` parameter. **Recommendations** For Food Ordering System version 1.0, avoid using the `ID` parameter in SQL queries until a fix is available. Consider implementing input validation and sanitization for the `ID` parameter to prevent malicious SQL queries.

**Name of the Vulnerable Software and Affected Versions** CMS Made Simple version 2.2.17 **Description** The issue allows for Remote Command Execution via the File Upload Function. **Recommendations** For CMS Made Simple version 2.2.17, update to a version that fixes this issue.

**Name of the Vulnerable Software and Affected Versions** ReQlogic version 11.3 **Description** The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `POBatch` and `WaitDuration` parameters. This enables the execution of malicious code on the web application. **Recommendations** For ReQlogic version 11.3, consider restricting access to the `POBatch` and `WaitDuration` parameters to minimize the risk of exploitation. Avoid using these parameters until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.