CVE-2021-26830

SQL Injection in Tribalsystems Zenario CMS 8.8.52729 allows remote attackers to access the database or delete the plugin. This is accomplished via the ID input field of ajax.php in the Pugin library - delete module...

Sql injection

SQL Injection in Tribalsystems Zenario CMS 8.8.52729 allows remote attackers to access the database or delete the plugin. This is accomplished via the ID input field of ajax.php in the Pugin library - delete module...

CVE-2021-26830

SQL Injection in Tribalsystems Zenario CMS 8.8.52729 allows remote attackers to access the database or delete the plugin. This is accomplished via the "ID" input field of ajax.php in the "Pugin library - delete" module...

PT-2021-17154

Name of the Vulnerable Software and Affected Versions: Tribalsystems Zenario CMS versions prior to 8.8.52729 Description: The issue allows remote attackers to access the database or delete the plugin. This is accomplished via the ID input field of "ajax.php" in the Pugin library - delete module...

CVE-2021-26830: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection in Tribalsystems Zenario CMS 8.8.52729 allows remote attackers to access the database or delete the plugin. This is accomplished via the ID input field of ajax.php in the Pugin library - delete module...

CVE-2021-24199

The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajax.php?action=getwdtable&tableid=1, on the 'start' HTTP POST parameter. Th...

PT-2021-15745

Name of the Vulnerable Software and Affected Versions: wpDataTables – Tables & Table Charts premium WordPress plugin versions prior to 3.4.2 Description: The issue allows a low-privilege authenticated user to perform Boolean-based blind SQL Injection on the "/wp-admin/admin-ajax.php?action=get...

CVE-2021-24200: Improper Neutralization of Special Elements used in an SQL Command

The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajax.php?action=getwdtable&tableid=1, on the 'length' HTTP POST parameter...

CVE-2021-24199: Improper Neutralization of Special Elements used in an SQL Command

The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajax.php?action=getwdtable&tableid=1, on the 'start' HTTP POST parameter. Th...

WPBakery Page Builder Clipboard < 4.5.6 - Subscriber+ Stored Cross-Site Scripting (XSS)

An AJAX action registered by the plugin did not have capability checks nor sanitization, allowing low privilege users subscriber+ to call it and set XSS payloads, which will be triggered in all backend pages. Version 4.5.6 fixed the XSS issue with sanitization of the parameters, but did not fix t...

CVE-2020-28172: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in Simple College Website 1.0 allows remote unauthenticated attackers to bypass the admin authentication mechanism in collegewebsite/admin/ajax.php?action=login, thus gaining access to the website administrative panel...

CVE-2020-28173: Unrestricted Upload of File with Dangerous Type

Simple College Website 1.0 allows a user to conduct remote code execution via /alumni/admin/ajax.php?action=savesettings when uploading a malicious file using the image upload functionality, which is stored in /alumni/admin/assets/uploads/...

PT-2021-11455

Name of the Vulnerable Software and Affected Versions: Simple College Website version 1.0 Description: The issue allows a user to conduct remote code execution via the "/alumni/admin/ajax.php?action=save settings" API endpoint when uploading a malicious file using the image upload functionality...

PT-2021-11454

Name of the Vulnerable Software and Affected Versions: Simple College Website version 1.0 Description: A SQL injection issue allows remote unauthenticated attackers to bypass the admin authentication mechanism, gaining access to the website administrative panel through the "college...

CVE-2021-24140: Improper Neutralization of Special Elements used in an SQL Command

Unvalidated input in the Ajax Load More WordPress plugin, versions before 5.3.2, lead to SQL Injection in POST /wp-admin/admin-ajax.php with param repeater=' or sleep5&type=test...

PT-2021-15686

Name of the Vulnerable Software and Affected Versions: Ajax Load More WordPress plugin versions prior to 5.3.2 Description: The issue concerns unvalidated input in the Ajax Load More WordPress plugin, leading to SQL Injection. This occurs in the POST /wp-admin/admin-ajax.php endpoint with the...

Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_answers_by_question

The tutorquizbuildergetanswersbyquestion AJAX action from the plugin was vulnerable to UNION based SQL injection that could be exploited by students. python3 sqlmap.py -r /tutorunion.txt --dbms=mysql --technique=U -p questionid --dump Where tutorunion.txt is POST /wp-admin/admin-ajax.php HTTP/1.1...

Sql injection

wpDataTables before 3.4.1 mishandles order direction for server-side tables, aka admin-ajax.php?action=getwdtable order0dir SQL injection...

CVE-2021-26754: Improper Neutralization of Special Elements used in an SQL Command

wpDataTables before 3.4.1 mishandles order direction for server-side tables, aka admin-ajax.php?action=getwdtable order0dir SQL injection...

PT-2021-17125

Name of the Vulnerable Software and Affected Versions wpDataTables versions prior to 3.4.1 Description The issue is related to how wpDataTables handles order direction for server-side tables, leading to a SQL injection. This can be exploited through the "admin-ajax.php?action=get wdtable" endpoin...