Several vulnerabilities are detailed across various software and plugins, with severe consequences ranging from arbitrary file uploads to remote code execution. SandboxJS library versions prior to 0.8.36 allowed bypassing global object protection. CF Image Hosting Script 1.6.5 permits unauthorized database access, leading to picture deletion. The Tianxin Internet Behavior Management System has a command injection flaw allowing command execution. Contemporary Controls BASControl20 is vulnerable to packet forgery, leading to arbitrary requests. Ninja Forms and ProSolution WP Client WordPress plugins suffer from arbitrary file upload vulnerabilities. IBM Verify Identity Access Container versions have a privilege escalation vulnerability. Quick Playground WordPress plugin allows remote code execution via API endpoints. LibRaw has multiple heap-based buffer overflow vulnerabilities exploitable through crafted files. Weaver E-cology has a remote code execution vulnerability via a debug endpoint. Rukovoditel CRM is susceptible to reflected cross-site scripting (XSS). Chamilo LMS faces an OS command injection flaw during file movement. Lastly, Everest Forms plugin has a PHP object injection vulnerability.