Shuo Sheng

**Name of the Vulnerable Software and Affected Versions** SeaCMS version 12.9 **Description** The issue is related to a file deletion vulnerability. It can be exploited via the admin template.php file. **Recommendations** For SeaCMS version 12.9, consider restricting access to the admin template.php file until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Sourcecodester Online Medicine Ordering System version 1.0 **Description** The issue allows for arbitrary file deletion due to a function in the backend settings that can delete any files, initially intended for deleting pictures. **Recommendations** For Sourcecodester Online Medicine Ordering System version 1.0, consider restricting access to the file deletion function in the backend settings to minimize the risk of exploitation. As a temporary workaround, limit the ability to delete files to only necessary personnel or roles until a more permanent fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** BOSSCMS version 3.10 **Description** A Cross Site Scripting (XSS) issue allows attackers to run arbitrary code via the `header code` and `footer code` fields in code configuration. This enables attackers to execute malicious scripts on the affected system. **Recommendations** For BOSSCMS version 3.10, as a temporary workaround, consider restricting access to the code configuration fields, specifically the `header code` and `footer code` fields, until a patch is available. Avoid using these fields to input untrusted data. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SEMCMS version 4.8 **Description** An issue in SEMCMS allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the `upload.php` file. **Recommendations** For SEMCMS version 4.8, consider disabling access to the `upload.php` file as a temporary workaround until a patch is available. Restrict access to sensitive information and privileges to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SEMCMS version 4.8 **Description** The issue allows a remote attacker to obtain sensitive information via the `lgid` parameter in Banner.php. This is a result of a SQL injection vulnerability. **Recommendations** For SEMCMS version 4.8, consider restricting access to the Banner.php file or the `lgid` parameter to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the `lgid` parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** emlog version Pro 2.3 **Description** The issue allows remote attackers to execute arbitrary code via a crafted payload to the bottom of the homepage in the `footer info` parameter. This is a Cross Site Scripting (XSS) issue. **Recommendations** For emlog version Pro 2.3, consider restricting access to the `footer info` parameter to minimize the risk of exploitation. Avoid using the `footer info` parameter until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SEMCMS version 4.8 **Description** The issue allows a remote attacker to obtain sensitive information via the `ID` parameter in Banner.php. This is a result of a SQL injection vulnerability. **Recommendations** For SEMCMS version 4.8, consider restricting access to the Banner.php file until a patch is available. As a temporary workaround, avoid using the `ID` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** beescms version 4.0 **Description** The issue allows a remote attacker to execute arbitrary code via a file path that was not isolated and the suffix was not verified in admin template.php. This is an arbitrary file write vulnerability. **Recommendations** For beescms version 4.0, update to a version where the file path isolation and suffix verification have been properly implemented in admin template.php to prevent arbitrary file writes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.