A SQL injection vulnerability exists in 1000projects Online Project Report Submission and Evaluation System 1.0, allowing remote attackers to manipulate the batch_id argument. Yahoo! WebPlayer versions up to 2.0.6 are affected by Reflected Cross-site Scripting (XSS). WPMU Ldap Authentication versions up to 5.0.1 suffer from Cross-Site Request Forgery (CSRF) leading to Stored XSS. Drag and Drop File Upload for Elementor Forms versions up to 1.5.3 has an Unrestricted File Upload vulnerability allowing web shell uploads. Agiloft Release 28 has critical system packages downloaded over insecure HTTP and contains default credentials for privilege escalation. QbiCRMGateway by Ai3 has an Arbitrary File Reading vulnerability via Relative Path Traversal. Arista EOS platforms may accept maliciously formed UDP packets on port 3503. Poll, Survey & Quiz Maker Plugin by Opinion Stage versions up to 19.11.0 allows PHP Local File Inclusion. Asterisk versions prior to 20.15.2, 21.10.2, and 22.5.2 have a crash vulnerability in res_pjsip_authenticator_digest due to improper handling of SIP authorization headers. Tiktok Feed by bPlugins versions up to 1.0.21 have a Missing Authorization vulnerability.