Texuguinho1234

**Name of the Vulnerable Software and Affected Versions** Astro versions prior to 6.4.6 **Description** The `spreadAttributes` function in the server-side rendering pipeline iterates over object keys and passes them to the `addAttribute()` function, which interpolates the key into the HTML output without escaping. When a developer uses the spread syntax `{...props}` on an HTML element and the object keys originate from untrusted sources such as APIs, CMS, or URL parameters, an attacker can inject arbitrary HTML attributes. This includes event handlers like `onmousemove` and `onclick`, or breaking out of the attribute context to inject new elements, leading to cross-site scripting (XSS). **Recommendations** Update to version 6.4.6. As a temporary workaround, avoid using the spread syntax `{...props}` on HTML elements when the object keys come from untrusted sources.

**Name of the Vulnerable Software and Affected Versions** OpenCATS versions prior to 0.9.7.5 **Description** An issue exists in the DataGrid component where authenticated users can extract database contents. Attackers can perform time-based blind SQL injection—a technique used to infer data by observing the time the server takes to respond to specific queries—by injecting malicious SQL via the `sortDirection` parameter in the 'ajax/getDataGridPager.php' endpoint. **Recommendations** Update to a version newer than 0.9.7.4. As a temporary workaround, restrict or avoid using the `sortDirection` parameter in the 'ajax/getDataGridPager.php' endpoint.

**Name of the Vulnerable Software and Affected Versions** GitPython versions prior to 3.1.47 **Description** GitPython is a Python library used to interact with Git repositories. The ` clone()` function validates the `multi options` variable as an original list but then executes `shlex.split(" ".join(multi options))`. This allows a string that starts with a safe option, such as `--branch`, to pass validation while containing unsafe options like `--config core.hooksPath=/x`. After the split operation, the unsafe option becomes a separate token that Git applies, potentially leading to the execution of attacker-controlled hooks during the clone process. This issue also affects `Submodule.update()` via `clone multi options`. The vulnerability occurs when applications pass user-controlled input to `clone from()`, `clone()`, or `Submodule.update()`. **Recommendations** Update to version 3.1.47.

**Name of the Vulnerable Software and Affected Versions** Cacti versions prior to 1.2.31 **Description** An issue exists in the performance and fault management framework where improper handling of deserialized data leads to SQL Injection. In the 'managers.php' file, the application processes the `selected graphs array` variable using a custom unserialize function. While object injection is prevented, arbitrary string arrays can still be deserialized. These values are subsequently passed to the `db execute()` function and merged into a SQL DELETE statement via an implode operation without integer validation. This allows for SQL Injection when utilizing SNMP agent management permissions. **Recommendations** Update to version 1.2.31.

**Name of the Vulnerable Software and Affected Versions** Wazuh versions 4.0.0 through 4.14.2 **Description** Wazuh is a free and open source platform used for threat prevention, detection, and response. A Remote Code Execution (RCE) issue exists due to the deserialization of untrusted data within the cluster synchronization protocol. This affects deployments using cluster mode (master/worker architecture). An attacker who gains access to a worker node—via initial access, insider threats, or supply chain attacks—can achieve full RCE on the master node with root privileges by sending a specially crafted DAPI request. The issue involves the `as wazuh object()` function, unsafe reflective object loading, and implicit cluster trust assumptions, allowing for Python runtime abuse and dynamic import exploitation. **Recommendations** Update to version 4.14.3.