Thirukrishnan

**Name of the Vulnerable Software and Affected Versions** Unifiedtransform versions 2.X **Description** The issue is related to Stored Cross-Site Scripting (XSS) via the file upload feature in the Syllabus module. This allows for malicious scripts to be stored and executed on the server. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. The vulnerability is exploited through the file upload feature, but specific technical details such as API endpoints, vulnerable parameters, or function names are not provided. **Recommendations** For Unifiedtransform version 2.X, consider disabling the file upload feature in the Syllabus module as a temporary workaround until a patch is available. Restrict access to the Syllabus module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Minical version 1.0.0 **Description** The issue is related to Cross Site Scripting (XSS) and is caused by insufficient input validation in the application's user input handling in the security helper.php file. **Recommendations** For Minical version 1.0.0, ensure proper input validation is implemented in the security helper.php file to prevent XSS attacks. As a temporary workaround, consider restricting user input handling until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Minical version 1.0.0 **Description** The issue is related to Cross Site Request Forgery (CSRF) via the minical/public/application/controllers/settings/company.php file. This means an attacker could potentially trick a user into performing unintended actions on the web application. **Recommendations** For Minical version 1.0.0, as a temporary workaround, consider restricting access to the minical/public/application/controllers/settings/company.php file until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Minical versions 1.0.0 and earlier **Description** The issue is related to a CSV injection vulnerability that allows an attacker to execute remote code. This is due to insufficient input validation on the `Customer Name` field in the Accounting module, which is used to construct a CSV file. **Recommendations** For Minical versions 1.0.0 and earlier, update to a version that includes input validation for the `Customer Name` field in the Accounting module to prevent CSV injection attacks. As a temporary workaround, consider restricting input for the `Customer Name` field to minimize the risk of exploitation.