Peanut

**Name of the Vulnerable Software and Affected Versions** SourceCodester Employee Task Management System version 1.0 **Description** A critical issue has been found in the SourceCodester Employee Task Management System, affecting an unknown functionality of the file update-employee.php. The manipulation of the `admin id` argument leads to SQL injection. This issue can be exploited remotely. **Recommendations** For SourceCodester Employee Task Management System version 1.0, consider restricting access to the update-employee.php file until a patch is available. As a temporary workaround, avoid using the `admin id` argument in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Employee Task Management System version 1.0 **Description** A critical issue was found in the SourceCodester Employee Task Management System, affecting some unknown functionality of the file update-admin.php. The manipulation of the `admin id` argument leads to SQL injection. The attack can be launched remotely. **Recommendations** For SourceCodester Employee Task Management System version 1.0, consider disabling the `admin id` argument in the update-admin.php file as a temporary workaround until a patch is available. Restrict access to the update-admin.php file to minimize the risk of exploitation. Avoid using the `admin id` argument in the affected functionality until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** NFine Rapid Development Platform version 20230511 **Description** A vulnerability has been found in the NFine Rapid Development Platform, affecting an unknown functionality of the file "/SystemManage/User/GetGridJson? search=false&nd=1680855479750&rows=50&page=1&sidx=F CreatorTime+desc&sord=asc". This leads to improper access controls, and the attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted about this disclosure but did not respond. **Recommendations** For NFine Rapid Development Platform version 20230511, consider restricting access to the "/SystemManage/User/GetGridJson" endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NFine Rapid Development Platform version 20230511 **Description** A vulnerability was found in the NFine Rapid Development Platform, affecting some unknown functionality of the file "/SystemManage/Organize/GetTreeGridJson? search=false&nd=1681813520783&rows=10000&page=1&sidx=&sord=asc". The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For NFine Rapid Development Platform version 20230511, consider restricting access to the "/SystemManage/Organize/GetTreeGridJson" API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NFine Rapid Development Platform version 20230511 **Description** A problematic vulnerability has been found in the NFine Rapid Development Platform, affecting an unknown part of the file "/SystemManage/Role/GetGridJson?keyword=&page=1&rows=20". This vulnerability leads to improper access controls and can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted about this disclosure but did not respond. **Recommendations** For NFine Rapid Development Platform version 20230511, consider restricting access to the "/SystemManage/Role/GetGridJson" endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the `keyword`, `page`, and `rows` parameters in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Shaoxing Background Management System (affected versions not specified) **Description** A critical issue has been found in the system, affecting unknown code in the file /Default/Bd. The manipulation of the `id` argument leads to SQL injection. This issue can be exploited remotely. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dot Tech Smart Campus System (affected versions not specified) **Description** A problematic issue has been found in the system, affecting some unknown functionality of the file /services/Card/findUser. This leads to information disclosure and can be exploited remotely. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mediabridge Medialink (affected versions not specified) **Description** A critical issue was found in Mediabridge Medialink, affecting the file `/index.asp`, which leads to improper authentication. The attack can be initiated remotely. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PHP-Fusion version 6.0.204 **Description** The issue is related to a cross-site scripting (XSS) vulnerability. It allows remote attackers to inject arbitrary web script or HTML via nested tags in the `news body` parameter. Examples of elements that can be used for this purpose include "<me<meta>ta" and "<sc<script>ript>". **Recommendations** For PHP-Fusion version 6.0.204, avoid using nested tags in the `news body` parameter until a patch is available. As a temporary workaround, consider validating and sanitizing user input to prevent the injection of malicious scripts. Restrict access to the submit.php file to minimize the risk of exploitation.