Trong Pham

**Name of the Vulnerable Software and Affected Versions** Avada Builder (fusion-builder) versions prior to 3.15.3 **Description** Unauthenticated remote code execution is possible via PHP Function Injection. The issue occurs because the `wp conditional tags` case in the `Fusion Builder Conditional Render Helper::get value()` function passes attacker-controlled values from a base64-decoded JSON blob directly to `call user func()` without allowlist validation. This can be exploited through the 'fusion get widget markup' AJAX endpoint, which is registered for unauthenticated users via `wp ajax nopriv fusion get widget markup`. Although the endpoint is protected by a nonce `fusion load nonce`, this value is generated for user ID 0 and is deterministically exposed in the JavaScript output of any public page containing a Post Cards (`[fusion post cards]`) or Table of Contents (`[fusion table of contents]`) element. **Recommendations** Update the plugin to a version later than 3.15.2. As a temporary workaround, restrict access to the 'fusion get widget markup' AJAX endpoint or remove Post Cards and Table of Contents elements from public-facing pages to prevent the exposure of the `fusion load nonce`.

**Name of the Vulnerable Software and Affected Versions** CraftCMS version 3.8.1 **Description** The issue allows a remote attacker to execute arbitrary code via a crafted script to the `Section` parameter. This enables the attacker to potentially gain control over the system, allowing for unauthorized actions. **Recommendations** For CraftCMS version 3.8.1, consider disabling access to the `Section` parameter until a patch is available. As a temporary workaround, restrict the ability to execute scripts via this parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SmartVista SVFE2 version 2.2.22 **Description** The issue is a SQL injection vulnerability. It can be exploited via the `UserForm:j id90` parameter at the "/SVFE2/pages/feegroups/mcc group.jsf" endpoint. **Recommendations** For SmartVista SVFE2 version 2.2.22, consider restricting access to the vulnerable endpoint "/SVFE2/pages/feegroups/mcc group.jsf" to minimize the risk of exploitation. Avoid using the `UserForm:j id90` parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SmartVista SVFE2 version 2.2.22 **Description** A SQL injection issue was found in SmartVista SVFE2, specifically via the `voiceAudit:j id97` parameter at the "/SVFE2/pages/audit/voiceaudit.jsf" endpoint. This allows for potential exploitation. **Recommendations** For SmartVista SVFE2 version 2.2.22, consider restricting access to the `/SVFE2/pages/audit/voiceaudit.jsf` endpoint until a patch is available. As a temporary workaround, avoid using the `voiceAudit:j id97` parameter in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SmartVista SVFE2 version 2.2.22 **Description** A SQL injection issue was found in SmartVista SVFE2. The issue is related to the `UserForm:j id88`, `UserForm:j id90`, and `UserForm:j id92` parameters at the "/SVFE2/pages/feegroups/country group.jsf" endpoint. **Recommendations** For SmartVista SVFE2 version 2.2.22, as a temporary workaround, consider restricting access to the vulnerable parameters `UserForm:j id88`, `UserForm:j id90`, and `UserForm:j id92` in the "/SVFE2/pages/feegroups/country group.jsf" endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.