A reflected cross-site scripting (XSS) vulnerability in the component Query.php of arPHP v3.6.0 allows attackers to execute arbitrary web scripts.

Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter.

College Management System v1.0 was discovered to contain a SQL injection vulnerability via the course_code parameter.

Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Admin panel via the $_GET['page'] parameter.

Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Admin panel via the $_GET['s'] parameter.

Seacms v11.6 was discovered to contain a remote command execution (RCE) vulnerability via the Mail Server Settings.

Halo-1.5.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via \admin\index.html#/system/tools.

A use after free in r_reg_set_value function in radare2 5.4.2 and 5.4.0.

A heap buffer overflow in r_read_le32 function in radare25.4.2 and 5.4.0.

A use after free in r_reg_get_name_idx function in radare2 5.4.2 and 5.4.0.

A null pointer deference in __core_anal_fcn function in radare2 5.4.2 and 5.4.0.

A heap buffer overflow in vax_opfunction in radare2 5.4.2 and 5.4.0.

A heap buffer overflow in r_sleb128 function in radare2 5.4.2 and 5.4.0.

An incorrect access control issue in Sandboxie Classic v5.55.13 allows attackers to cause a Denial of Service (DoS) in the Sandbox via a crafted executable.

Simple Bakery Shop Management System v1.0 contains a file disclosure via /bsms/?page=products.

Car Rental System v1.0 contains an arbitrary file upload vulnerability via the Add Car component which allows attackers to upload a webshell and execute arbitrary code.

SQL Injection vulnerability in Victor CMS v1.0, via the user_name parameter to /includes/login.php.

Verydows v2.0 was discovered to contain an arbitrary file deletion vulnerability via \backend\database_controller.php.

Verydows v2.0 was discovered to contain an arbitrary file deletion vulnerability via \backend\file_controller.php.

ShopXO v2.2.5 and below was discovered to contain a system re-install vulnerability via the Add function in app/install/controller/Index.php.