Simo Ben Youssef

**Name of the Vulnerable Software and Affected Versions** Showbiz Pro plugin versions 1.7.1 and earlier **Description** The issue allows for PHP code execution by uploading a .php file within a ZIP archive. **Recommendations** For versions 1.7.1 and earlier, update to a version later than 1.7.1 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Incredible PBX version 11 2.0.6.5.0 **Description** The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in the `APPTMIN`, `APPTHR`, `APPTDA`, `APPTMO`, `APPTYR`, or `APPTPHONE` parameters in the reminders/index.php file. **Recommendations** For Incredible PBX version 11 2.0.6.5.0, as a temporary workaround, consider restricting access to the reminders/index.php file until a patch is available. Avoid using the parameters `APPTMIN`, `APPTHR`, `APPTDA`, `APPTMO`, `APPTYR`, or `APPTPHONE` in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Site@School versions 2.4.02 and earlier **Description** The issue concerns an unrestricted file upload vulnerability. This vulnerability allows remote attackers to upload and execute arbitrary files with executable extensions. **Recommendations** For versions 2.4.02 and earlier, consider restricting access to the starnet/editors/htmlarea/popups/images.php file until a patch is available. As a temporary workaround, disable the execution of files with executable extensions in the affected directory to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Outblaze (affected versions not specified) **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `file` parameter. This could potentially lead to unauthorized actions on the affected system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** cPanel versions 10 and earlier **Description** The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via several parameters, including the `email` parameter to endpoints like "editquota.html" or "dodelpop.html", the `showtree` parameter to "diskusage.html", or the `mon`, `year`, `target`, or `domain` parameters to "stats/detailbw.html". **Recommendations** For cPanel versions 10 and earlier, update to a version later than 10 to resolve the issue. As a temporary workaround, consider restricting access to the affected endpoints, such as "editquota.html", "dodelpop.html", "diskusage.html", and "stats/detailbw.html", until a patch is available. Avoid using the vulnerable parameters, such as `email`, `showtree`, `mon`, `year`, `target`, or `domain`, in the affected endpoints until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** cPanel (affected versions not specified) **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `numdays` parameter in the webmailaging.cgi component. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.