Yago Martins

**Name of the Vulnerable Software and Affected Versions** Quantico Tecnologia PRMV version 6.48 **Description** A critical vulnerability was found in Quantico Tecnologia PRMV, affecting an unknown part of the file `/admin/login.php` of the component Login Endpoint. The manipulation of the `username` argument leads to SQL injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For Quantico Tecnologia PRMV version 6.48, as a temporary workaround, consider restricting access to the `/admin/login.php` endpoint until a patch is available. Avoid using the `username` argument in the affected Login Endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AT Software Solutions ATSVD versions up to 3.4.1 **Description** A critical issue affects some unknown functionality of the component Esqueceu a senha. The manipulation of the `txtCPF` argument leads to SQL injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. **Recommendations** Upgrading to version 3.4.2 is able to address this issue. It is recommended to upgrade the affected component. As a temporary workaround, consider restricting the use of the `txtCPF` argument to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** AT Software Solutions ATSVD versions up to 3.4.1 **Description** A critical issue was found in the Login Endpoint component, specifically in the /login.aspx file, where manipulation of the `txtUsuario` argument leads to sql injection. This issue can be exploited remotely. **Recommendations** For AT Software Solutions ATSVD versions up to 3.4.1, upgrade to version 3.4.2 to address this issue.

**Name of the Vulnerable Software and Affected Versions** Benner Connecta version 1.0.5330 **Description** A critical issue was discovered in the software, affecting an unknown functionality related to the file /Usuarios/Usuario/EditarLogado/. The manipulation of the `Handle` argument leads to improper control of resource identifiers, allowing for remote attacks. The vendor was contacted about this issue but did not respond. **Recommendations** For Benner Connecta version 1.0.5330, as a temporary workaround, consider restricting access to the /Usuarios/Usuario/EditarLogado/ file until a patch is available. Avoid manipulating the `Handle` argument in this context to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Benner ModernaNet versions 1.1.0 and earlier **Description** A critical issue has been found in Benner ModernaNet, affecting an unknown part of the file `/AGE0000700/GetHorariosDoDia?idespec=0&idproced=1103&data=2025-02-25+19%3A25&agserv=0&convenio=1&localatend=1&idplano=5&pesfis=01&idprofissional=0&target=.horarios--dia--d0& =1739371223797`. The manipulation leads to SQL injection, and it is possible to initiate the attack remotely. Upgrading to version 1.1.1 can address this issue. **Recommendations** To resolve the issue, upgrade to version 1.1.1. As a temporary workaround, consider restricting access to the vulnerable API endpoint `/AGE0000700/GetHorariosDoDia` until the update is applied. Avoid using the parameters `idespec`, `idproced`, `data`, `agserv`, `convenio`, `localatend`, `idplano`, `pesfis`, `idprofissional`, and `target` in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Benner ModernaNet versions up to 1.1.0 **Description** A critical issue affects some unknown functionality of the file /Home/JS CarregaCombo?formName=DADOS PESSOAIS PLANO&additionalCondition=&insideParameters=&elementToReturn=DADOS PESSOAIS PLANO&ordenarPelaDescricao=true&direcaoOrdenacao=asc& =1739290047295. The manipulation leads to sql injection. The attack may be launched remotely. **Recommendations** To address this issue, upgrade to version 1.1.1. It is recommended to upgrade the affected component. As a temporary workaround, consider restricting access to the /Home/JS CarregaCombo API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Benner ModernaNet versions 1.1.0 and earlier **Description** A critical issue has been identified in Benner ModernaNet, affecting unknown code in the file /AGE0000700/GetImageMedico?fooId=1. The manipulation of the `fooId` argument leads to improper control of resource identifiers, allowing remote attacks. Upgrading to version 1.1.1 can address this issue. **Recommendations** For Benner ModernaNet versions 1.1.0 and earlier, upgrade to version 1.1.1 to resolve the issue. As a temporary workaround, consider restricting access to the /AGE0000700/GetImageMedico API endpoint until the update is applied. Avoid using the `fooId` argument in the affected API endpoint until the issue is resolved.