Tri Doan

**Name of the Vulnerable Software and Affected Versions** eleopard Behance Portfolio Manager versions 1.7.4 and earlier **Description** The issue is related to an SQL Injection vulnerability, specifically Improper Neutralization of Special Elements used in an SQL Command. This allows for Blind SQL Injection, which can be exploited. **Recommendations** For versions 1.7.4 and earlier, update to a version that contains a fix for this issue, if available. As a temporary workaround, consider restricting access to sensitive database queries to minimize the risk of exploitation. Avoid using user-supplied input in SQL commands until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Dima Take Action versions 1.0.0 through 1.0.5 **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attackers to inject malicious scripts into web pages. **Recommendations** For versions 1.0.0 through 1.0.5, update to a version that includes a fix for this issue to prevent Stored XSS attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Appointify versions 1.0.8 and earlier **Description** The issue allows uploading a web shell to a web server due to unrestricted file upload with dangerous file types. This enables potential attackers to upload malicious files, such as web shells, to the server. **Recommendations** For versions 1.0.8 and earlier, consider restricting or disabling file upload functionality until a fix is available. As a temporary workaround, restrict access to sensitive areas of the web server to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** NotFound Social Links versions n/a through 1.2 **Description** The issue is related to an SQL Injection vulnerability, specifically a Blind SQL Injection, due to the improper neutralization of special elements used in an SQL command. **Recommendations** For versions n/a through 1.2, update to a version that fixes the SQL Injection vulnerability.

**Name of the Vulnerable Software and Affected Versions** Like dislike plus counter versions 1.0 and earlier **Description** The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting (XSS) vulnerability. Specifically, it is a Stored XSS vulnerability. This means that an attacker can inject malicious scripts into the website, which are then stored and executed when other users access the site. **Recommendations** For versions 1.0 and earlier, update to a version that fixes the Stored XSS issue, as no specific fix is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** sudipto Link to URL / Post versions n/a through 1.3 **Description** The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as a SQL Injection vulnerability. This allows for Blind SQL Injection. **Recommendations** For versions n/a through 1.3, consider disabling the SQL command functionality until a patch is available. As a temporary workaround, restrict access to the `/Post` endpoint to minimize the risk of exploitation. Avoid using special elements in SQL commands in the affected Link to URL / Post until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.