Authentication flaw

An issue was discovered in SourceCodester Seat Reservation System 1.0. The file adminclass.php does not perform input validation on the username and password parameters. An attacker can send malicious input in the post request to /admin/ajax.php?action=login and bypass authentication, extract...

PT-2020-16188

Name of the Vulnerable Software and Affected Versions SourceCodester Seat Reservation System version 1.0 Description The issue concerns a lack of input validation on the username and password parameters in the admin class.php file. This allows an attacker to send malicious input in the POST reque...

Autoptimize < 2.7.7 - Authenticated Arbitrary File Upload

The aoccssimport AJAX call does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as PHP, leading to RCE. https://drive.google.com/file/d/1siZsDiJsYRCw58Ksram5zBJOVbs-Hio1/view?usp=sharing POST /wp-admin/admin-ajax.php HTTP/1...

CVE-2020-20633

ajaxpolicygenerator in admin/modules/cli-policy-generator/classes/class-policy-generator-ajax.php in GDPR Cookie Consent cookie-law-info 1.8.2 and below plugin for WordPress, allows authenticated stored XSS and privilege escalation...

CVE-2020-20633

ajaxpolicygenerator in admin/modules/cli-policy-generator/classes/class-policy-generator-ajax.php in GDPR Cookie Consent cookie-law-info 1.8.2 and below plugin for WordPress, allows authenticated stored XSS and privilege escalation...

CVE-2020-20633

CVE-2020-20633 affects the WordPress plugin GDPR Cookie Consent (cookie-law-info) versions 1.8.2 and earlier, via ajax_policy_generator in admin/modules/cli-policy-generator/classes/class-policy-generator-ajax.php. The vulnerability allows authenticated stored XSS and privilege escalation. The co...

Quiz and Survey Master < 7.0.1 - Arbitrary File Upload

This flaw made it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution. Set-up quiz that accepts file uploads, then upload file and change content-type to one set as approved. history.pushState'', '', '/' function submitRequest var xhr = new...

Newsletter < 6.8.2 - Authenticated Cross-Site Scripting (XSS)

Newsletter suffers from an Authenticated Reflected Cross-Site ScriptingXSS vulnerability via the ‘tnpcrender’ AJAX action found in newsletter/emails/emails.php. Due to how the corresponding ‘tnpcrendercallback‘ function decodes input via the ‘restoreoptionsfromrequest’ function and renders them v...

CVE-2020-13483

The Web Application Firewall in Bitrix24 through 20.0.0 allows XSS via the itemsITEMSID parameter to the components/bitrix/mobileapp.list/ajax.php/ URI...

CVE-2020-13484

Bitrix24 (up to and including 20.0.975, and earlier) is affected by an SSRF vulnerability in services/main/ajax.php?action=attachUrlPreview. The root cause is an insecure handling of an intranet URL when the destination HTML document contains a tag that is followed by an intranet URL. This allow...

PT-2020-13566

Name of the Vulnerable Software and Affected Versions Bitrix24 versions prior to 20.0.0 Description The issue concerns a security problem where an attacker can execute malicious scripts on a user's browser, potentially leading to unauthorized actions. This is achieved by exploiting the itemsITEMS...

PT-2020-13567

Name of the Vulnerable Software and Affected Versions Bitrix24 versions prior to 20.0.976 Description The issue allows for Server-Side Request Forgery SSRF via an intranet IP address in the "services/main/ajax.php?action=attachUrlPreview" API endpoint, specifically through the url parameter. This...

CVE-2020-13483: Improper Neutralization of Input During Web Page Generation

The Web Application Firewall in Bitrix24 through 20.0.0 allows XSS via the itemsITEMSID parameter to the components/bitrix/mobileapp.list/ajax.php/ URI...

CVE-2020-13484: Server-Side Request Forgery (SSRF)

Bitrix24 through 20.0.975 allows SSRF via an intranet IP address in the services/main/ajax.php?action=attachUrlPreview url parameter, if the destination URL hosts an HTML document containing '...

CVE-2020-14962

Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Title aka imageTitle or Caption aka description field of an image to wp-admin/admin-ajax.php...

Cross site scripting

Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Title aka imageTitle or Caption aka description field of an image to wp-admin/admin-ajax.php...

CVE-2020-14962

Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Title aka imageTitle or Caption aka description field of an image to wp-admin/admin-ajax.php...

CVE-2020-14962

The CVE-2020-14962 issue affects the WordPress Final Tiles Gallery/FTG Lite plugin (versions before 3.4.19). The underlying vulnerability is Cross-Site Scripting (XSS) in the image handling: attacker-supplied input in the image Title (imageTitle) or Description (caption) fields passed to wp-admin...

PT-2020-14091

Name of the Vulnerable Software and Affected Versions Final Tiles Gallery plugin versions prior to 3.4.19 Description The issue allows remote attackers to inject arbitrary web script or HTML via the imageTitle or description field of an image to the "/wp-admin/admin-ajax.php" API endpoint...

CVE-2020-14962: Improper Neutralization of Input During Web Page Generation

Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Title aka imageTitle or Caption aka description field of an image to wp-admin/admin-ajax.php...