Piyush Patil

**Name of the Vulnerable Software and Affected Versions** SEO Panel versions prior to 4.9.0 **Description** SEO Panel versions prior to 4.9.0 contain a blind SQL injection in the `archive.php` page. Authenticated attackers can manipulate database queries through the `order col` parameter. Attackers can extract database information by injecting malicious SQL code into the `order col` parameter. The `order col` parameter is vulnerable to SQL injection attacks. **Recommendations** Update SEO Panel to version 4.9.0 or later.

**Name of the Vulnerable Software and Affected Versions** eLabFTW versions prior to 4.0.0 **Description** This issue affects an open source electronic lab notebook for research labs, allowing an attacker to make GET requests on behalf of the server. The attack is "blind" because the attacker cannot see the result of the request. **Recommendations** For versions prior to 4.0.0, update to version 4.0.0 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Plone CMS version 5.2.3 Description: A stored cross-site scripting (XSS) issue exists in the site-controlpanel via the `form.widgets.site title` parameter. This allows for potential malicious script execution. Recommendations: For Plone CMS version 5.2.3, consider restricting access to the site-controlpanel until a patch is available. As a temporary workaround, avoid using the `form.widgets.site title` parameter in the affected site-controlpanel to minimize the risk of exploitation.