Sirgod

**Name of the Vulnerable Software and Affected Versions** MyBackup version 1.4.0 **Description** The issue allows remote authenticated users to execute arbitrary PHP code via a URL in the `main content` parameter in the index.php file. **Recommendations** For MyBackup version 1.4.0, avoid using the `main content` parameter in the index.php file until the issue is resolved. As a temporary workaround, consider restricting access to the index.php file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** MyBackup version 1.4.0 **Description** A directory traversal issue exists, allowing remote attackers to read arbitrary files by using a .. (dot dot) in the `filename` parameter. **Recommendations** For MyBackup version 1.4.0, consider restricting access to the `down.php` file until a patch is available, and avoid using the `filename` parameter with untrusted input.

**Name of the Vulnerable Software and Affected Versions** Movie PHP Script version 2.0 **Description** The issue allows remote attackers to execute arbitrary PHP code via the `anticode` parameter in the system/services/init.php file. **Recommendations** For Movie PHP Script version 2.0, consider restricting access to the `anticode` parameter in the system/services/init.php file until a patch is available. Avoid using the `anticode` parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** BandSite CMS version 1.1.4 **Description** The issue allows remote authenticated administrators to execute arbitrary PHP code by uploading a file with an executable extension via an "addphotos" action to "adminpanel/index.php", and then accessing the file via a direct request with an "images/gallery/" directory name. **Recommendations** For BandSite CMS version 1.1.4, consider restricting access to the "adminpanel/scripts/addphotos.php" script to prevent unauthorized file uploads until a patch is available. As a temporary workaround, restrict the ability to upload files with executable extensions in the "addphotos" action to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** BandSite CMS version 1.1.4 **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `memid` parameter to the "members.php" endpoint. **Recommendations** For BandSite CMS version 1.1.4, consider restricting access to the `members.php` endpoint until a patch is available, and avoid using the `memid` parameter in this endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** BrotherSoft EW-MusicPlayer version 0.8 **Description** The issue is a stack-based buffer overflow that can be triggered by a remote attacker sending a long string in a malformed playlist (.m3u) file. This can cause a denial of service, resulting in an application crash, or potentially allow the execution of arbitrary code. **Recommendations** For BrotherSoft EW-MusicPlayer version 0.8, consider avoiding the use of malformed playlist files until a patch is available. As a temporary workaround, restrict the processing of long strings in .m3u files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Beatport Player version 1.0.0.0 **Description** The issue is a stack-based buffer overflow in TraktorBeatport.exe, allowing remote attackers to execute arbitrary code via a long string in a malformed playlist (.m3u) file. **Recommendations** For Beatport Player version 1.0.0.0, consider avoiding the use of malformed playlist (.m3u) files until a patch is available. As a temporary workaround, restrict access to the TraktorBeatport.exe module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** BrotherSoft BMXPlay version 0.4.4b **Description** The issue is related to a buffer overflow that can be triggered by a long string in a .BMX file, potentially allowing remote attackers to cause the application to crash or possibly execute arbitrary code. **Recommendations** For BrotherSoft BMXPlay version 0.4.4b, consider avoiding the use of .BMX files with long strings until a patch is available. As a temporary workaround, restrict the handling of .BMX files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Quickdev 4 PHP (affected versions not specified) **Description** The issue allows remote attackers to read arbitrary files via a .. (dot dot) in the `file` parameter of the "download.php" API endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netpet CMS version 1.9 **Description** A directory traversal issue exists, allowing remote attackers to include and execute arbitrary local files. This is achieved by using a .. (dot dot) in the `language` parameter of the confirm.php file. **Recommendations** For Netpet CMS version 1.9, consider restricting access to the confirm.php file until a patch is available, or apply configuration changes to prevent directory traversal attacks, such as validating and sanitizing user input for the `language` parameter.

**Name of the Vulnerable Software and Affected Versions** TT Web Site Manager version 0.5 **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is possible when the `magic quotes gpc` setting is disabled. The `tt name` parameter is vulnerable to SQL injection. **Recommendations** For TT Web Site Manager version 0.5, consider disabling the use of the `tt name` parameter until a patch is available. Additionally, enabling `magic quotes gpc` may help mitigate the risk of SQL injection attacks.

**Name of the Vulnerable Software and Affected Versions** Limny version 1.01 **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is possible due to a SQL injection vulnerability in the CheckLogin function, specifically when the magic quotes gpc setting is disabled. The vulnerability can be exploited via the `username` parameter. **Recommendations** For Limny version 1.01, consider disabling the CheckLogin function or restricting access to it until a patch is available. Additionally, enabling magic quotes gpc can help mitigate the risk of SQL injection attacks.

**Name of the Vulnerable Software and Affected Versions** SimpleLoginSys version 0.5 **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is possible via the `username` parameter in the "checkuser.php" file when magic quotes gpc is disabled. **Recommendations** For SimpleLoginSys version 0.5, consider disabling the use of the `username` parameter in the checkuser.php file until a patch is available, or enable magic quotes gpc to prevent SQL injection attacks.

**Name of the Vulnerable Software and Affected Versions** MCshoutbox version 1.1 **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the `loginerror` parameter in the admin login.php file. **Recommendations** For MCshoutbox version 1.1, consider restricting access to the admin login.php file until a patch is available, and avoid using the `loginerror` parameter in this context to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** MCshoutbox version 1.1 **Description** The issue concerns SQL injection vulnerabilities in the scr login.php file. When magic quotes gpc is disabled, remote attackers can execute arbitrary SQL commands via the `username` and `password` parameters. **Recommendations** For MCshoutbox version 1.1, consider disabling the scr login.php file or restricting access to it until a patch is available. As a temporary workaround, enable magic quotes gpc to prevent SQL injection attacks. Avoid using the `username` and `password` parameters in the affected login functionality until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** MCshoutbox version 1.1 **Description** The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension to admin.php, then accessing it via a direct request to the file in smilies/. **Recommendations** For MCshoutbox version 1.1, consider restricting access to the `admin.php` file and the `smilies/` directory to prevent exploitation until a patch is available. As a temporary workaround, avoid using the file upload feature in `admin.php` until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** JoxTechnology Ajox Poll (affected versions not specified) **Description** The issue concerns improper access restriction to the admin/managepoll.php page, allowing remote attackers to bypass authentication and gain administrative access through a direct request. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CMSphp version 0.21 **Description** A directory traversal issue exists, allowing remote attackers to include and execute arbitrary local files. This is achieved by using a .. (dot dot) in the `mod file` parameter of the modules.php file. **Recommendations** For CMSphp version 0.21, consider restricting access to the modules.php file or the `mod file` parameter to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the `mod file` parameter with untrusted input.

**Name of the Vulnerable Software and Affected Versions** CMSphp version 0.21 **Description** The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the `cook user` parameter to "index.php" or the `name` parameter to "modules.php". **Recommendations** For CMSphp version 0.21, avoid using the `cook user` parameter in the "index.php" endpoint and the `name` parameter in the "modules.php" endpoint until the issue is resolved. Consider restricting access to these endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** d.net CMS (affected versions not specified) **Description** The issue concerns SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. This can be achieved via the "page" parameter to "index.php". Additionally, remote authenticated administrators can exploit this issue via the `edit id` and ` p` parameters in a "news" action to "dnet admin/index.php". **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.