2319 matches found
CVE-2015-9332
The CVE-2015-9332 issue affects the WordPress uninstall plugin (before v1.2). The vulnerability is a Cross-Site Request Forgery (CSRF) that can trigger uninstall to delete all database tables via wp-admin/admin-ajax.php?action=uninstall, as described in multiple sources (WordPress uninstall plugi...
PT-2019-7291
Name of the Vulnerable Software and Affected Versions WordPress uninstall plugin versions prior to 1.2 Description The issue allows for CSRF, enabling the deletion of all tables via the "wp-admin/admin-ajax.php?action=uninstall" API endpoint. Recommendations For versions prior to 1.2, update to...
CVE-2015-9332: Cross-Site Request Forgery (CSRF)
The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI...
PT-2019-13879
Name of the Vulnerable Software and Affected Versions REDCap versions prior to 9.3.0 Description The issue allows for time-based SQL injection in the edit calendar event via the cal id parameter. An attacker can exploit this to obtain a user's login sessionid from the database and then re-login...
CVE-2019-14790
The limb-gallery aka Limb Gallery plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter,...
Code injection
The toggle-the-title aka Toggle The Title plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=updatetitleoptions isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter...
CVE-2019-14790
The limb-gallery aka Limb Gallery plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter,...
CVE-2019-14790
The limb-gallery aka Limb Gallery plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter,...
CVE-2019-14790
The CVE-2019-14790 entry concerns the WordPress plugin limb-gallery (aka Limb Gallery) up to version 1.4.0. The vulnerability is a Cross-Site Scripting (XSS) flaw exposed via the parameter wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode in the GrsGalleryAjax shortcode task. Publ...
PT-2019-13835
Name of the Vulnerable Software and Affected Versions Limb Gallery plugin version 1.4.0 Description The issue concerns a cross-site scripting XSS problem. It is exploited through the "wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode" API endpoint, specifically via the task...
PT-2019-13840
Name of the Vulnerable Software and Affected Versions Toggle The Title plugin version 1.4 Description The issue concerns a problem with the Toggle The Title plugin for WordPress. It is possible to exploit this issue via the wp-admin/admin-ajax.php endpoint, specifically through the action=update...
CVE-2019-14788: Improper Limitation of a Pathname to a Restricted Directory
wp-admin/admin-ajax.php?action=newslettersexportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultant remote PHP code execution via the subscribers11 parameter in conjunction with an exportfile=../ value...
CVE-2019-14790: Improper Neutralization of Input During Web Page Generation
The limb-gallery aka Limb Gallery plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter,...
CVE-2019-14795: Improper Neutralization of Input During Web Page Generation
The toggle-the-title aka Toggle The Title plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=updatetitleoptions isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter...
WordPress Download Manager 2.5 Cross Site Request Forgery
Exploit Title: CSRF vulnerabilities in WordPress Download Manager Plugin 2.5 Google Dork: inurl:"/wp-content/plugins/download-manager Date: 24 may, 2019 Exploit Author: Princy Edward Exploit Author Blog : https://prinyedward.blogspot.com/ Vendor Homepage: https://www.wpdownloadmanager.com/ Softwa...
PT-2019-7275
Name of the Vulnerable Software and Affected Versions wp-fastest-cache plugin versions prior to 0.8.4.9 Description The issue concerns SQL injection in the wp-fastest-cache plugin for WordPress. This occurs in the "wp-admin/admin-ajax.php" endpoint, specifically when the action parameter is set t...
CVE-2015-9316: Improper Neutralization of Special Elements used in an SQL Command
The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfcwppollsajaxrequest via the pollid parameter...
CVE-2019-14798
The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcodebwg tagtext parameter...