Summerxxoo

**Name of the Vulnerable Software and Affected Versions** WukongCRM-11.0-JAVA version 11.3.3 **Description** An arbitrary file upload vulnerability in the component /adminUser/updateImg allows attackers to execute arbitrary code via uploading a crafted file. This issue enables attackers to potentially gain control over the system by uploading malicious files. **Recommendations** For WukongCRM-11.0-JAVA version 11.3.3, as a temporary workaround, consider disabling the /adminUser/updateImg component until a patch is available. Restrict access to this component to minimize the risk of exploitation. Avoid using this component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Chat2DB version 0.3.5 **Description** A vulnerability in the /datagrip/upload component of Chat2DB allows attackers to execute arbitrary code via supplying a crafted XML input, exploiting an XML External Entity (XXE) injection flaw. **Recommendations** For Chat2DB version 0.3.5, as a temporary workaround, consider disabling the /datagrip/upload component until a patch is available. Restrict access to this component to minimize the risk of exploitation. Avoid using the vulnerable component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Stirling-PDF version 0.35.1 **Description** A Server-Side Request Forgery (SSRF) issue in the endpoint "http://{your-server}/url-to-pdf" of Stirling-PDF allows attackers to access sensitive information via a crafted request. This enables attackers to obtain confidential data through manipulated requests. **Recommendations** For Stirling-PDF version 0.35.1, as a temporary workaround, consider restricting access to the "http://{your-server}/url-to-pdf" endpoint until a patch is available. Avoid using this endpoint with untrusted input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.