Thiago Sena

**Name of the Vulnerable Software and Affected Versions** CMS ISWEB version 3.5.3 **Description** The issue allows an attacker to inject malicious SQL queries into the application, potentially obtaining sensitive information. **Recommendations** For CMS ISWEB version 3.5.3, update to a newer version that contains a fix for this issue, if available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CMS ISWEB version 3.5.3 **Description** The issue allows for directory traversal and local file download. This can be demonstrated through the "moduli/downloadFile.php" endpoint with a `file` parameter set to `oggetto documenti/../.././inc/config.php`, potentially allowing an attacker to gain control of the application due to credentials being present in the config.php file. **Recommendations** For CMS ISWEB version 3.5.3, consider restricting access to the `moduli/downloadFile.php` endpoint or implementing validation on the `file` parameter to prevent directory traversal attacks. As a temporary workaround, consider removing or securing the config.php file to prevent credential exposure until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Logitech Media Server versions 7.7.1 through 7.7.6, 7.9.0, 7.9.1 **Description** A DOM Based Cross Site Scripting (XSS) issue exists, which can be exploited via a crafted URI. **Recommendations** For versions 7.7.1 through 7.7.6, 7.9.0, 7.9.1, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** TP-LINK TL-MR3220 version (affected versions not specified) **Description** The issue is related to a cross-site scripting (XSS) vulnerability in the Wireless MAC Filtering page. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the `Description` field. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dreambox devices (affected versions not specified) **Description** The issue concerns a cross-site scripting (XSS) problem in the BouquetEditor WebPlugin. Specifically, it affects the "Name des Bouquets" field and the file parameter to the "/file" URI endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.