R3Ng4F

**Name of the Vulnerable Software and Affected Versions** SourceCodester Pizzafy Ecommerce System version 1.0 **Description** An issue in the Setting Handler component allows for remote SQL injection. This occurs within the `save settings()` function located in the '/pizzafy/admin/ajax.php?action=save settings' endpoint. **Recommendations** As a temporary workaround, restrict access to the '/pizzafy/admin/ajax.php?action=save settings' endpoint or disable the `save settings()` function until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this issue is the function save menu of the file /admin/ajax.php?action=save menu. Performing a manipulation results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Pizzafy Ecommerce System version 1.0 **Description** A flaw in the admin panel allows for remote SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. This issue occurs within the `save user()` function located in the '/admin/ajax.php?action=save user' endpoint. **Recommendations** As a temporary workaround, restrict access to the '/admin/ajax.php?action=save user' endpoint or disable the `save user()` function until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Pizzafy Ecommerce System version 1.0 **Description** Remote SQL injection is possible via the manipulation of the `pid` argument in the '/admin/ajax.php?action=add to cart' endpoint. SQL injection is a type of flaw that allows an attacker to interfere with the queries that an application makes to its database. **Recommendations** As a temporary workaround, avoid using the `pid` parameter in the '/admin/ajax.php?action=add to cart' endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FreeFloat FTP Server version 1.0 **Description** A critical vulnerability was found in the RETR Command Handler component of FreeFloat FTP Server, leading to a buffer overflow. The manipulation can be initiated remotely. The issue is related to a buffer copy without checking the size of the input, which is a classic buffer overflow. **Recommendations** For FreeFloat FTP Server version 1.0, as a temporary workaround, consider disabling the RETR command handler until a patch is available. Restrict access to the RETR command to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PCMan FTP Server version 2.0.7 **Description** A critical issue has been found in the NLST Command Handler component, leading to a buffer overflow. This can be exploited remotely. **Recommendations** For PCMan FTP Server version 2.0.7, consider disabling the NLST Command Handler until a patch is available. Restrict access to the NLST command to minimize the risk of exploitation.