Xue Yue

**Name of the Vulnerable Software and Affected Versions** SourceCodester Simple Music Player version 1.0 **Description** A critical issue has been found in the software, affecting an unknown function of the file save music.php. The manipulation of the `filename` argument leads to unrestricted upload. This issue can be exploited remotely. **Recommendations** For version 1.0, consider restricting access to the save music.php file to minimize the risk of exploitation. As a temporary workaround, avoid using the `filename` argument in the affected function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Monitoring of Students Cyber Accounts System version 1.0 **Description** A critical issue was found in the file login.php of the component POST Parameter Handler. The manipulation of the `un` argument leads to SQL injection. The attack can be launched remotely. **Recommendations** For SourceCodester Monitoring of Students Cyber Accounts System version 1.0, as a temporary workaround, consider restricting access to the `login.php` file until a patch is available. Avoid using the `un` argument in the affected POST parameter handler to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Monitoring of Students Cyber Accounts System version 1.0 **Description** A problematic issue has been found in the system, affecting some unknown functionality of the file modules/balance/index.php, specifically the POST Parameter Handler component. The manipulation of the `id` argument with the input "><script>alert(111)</script> leads to cross-site scripting. This issue can be exploited remotely. **Recommendations** For SourceCodester Monitoring of Students Cyber Accounts System version 1.0, as a temporary workaround, consider restricting access to the `modules/balance/index.php` file, specifically the `view=balancelist` endpoint, to minimize the risk of exploitation. Avoid using the `id` parameter in the affected POST request until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.