Orionyan

A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the function unlink of the file /system/htmly.php of the component Delete Username Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

A security flaw has been discovered in danpros HTMLy up to 3.1.1. This affects the function add content of the file /system/admin/admin.php of the component Admin Content Endpoint. Performing a manipulation of the argument oldfile results in path traversal. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

A weakness has been identified in danpros HTMLy up to 3.1.1. This vulnerability affects unknown code of the file /system/htmly.php of the component Author Name Handler. Executing a manipulation of the argument Name can lead to path traversal. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue affects the function isValidTLD of the file /backend/functions/src/cloud-functions/crawler.ts of the component Crawler/Puppeteer. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Class and Exam Timetabling System version 1.0 **Description** An issue exists in the `/edit exam1.php` file where a manipulation of the `ID` argument can lead to SQL injection, a technique used to interfere with the queries that an application makes to its database. This flaw allows a remote attacker to execute the attack over the network. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Class and Exam Timetabling System version 1.0 **Description** An issue exists in the `/edit course1.php` file where the manipulation of the `ID` argument allows for SQL injection. This allows a remote attacker to interfere with the database queries. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to data. **Recommendations** Update SourceCodester Class and Exametabling System version 1.0 to a patched version. As a temporary mitigation, restrict access to the `/edit course1.php` endpoint.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Class and Exam Timetabling System version 1.0 **Description** An issue exists in the `/edit room.php` file where manipulating the `ID` argument allows for SQL injection, a technique used to interfere with the queries that an application makes to its database. This attack can be initiated remotely. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.