Design/Logic Flaw

The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assetsurl parameter in assets/dialog.php, exploitable via wp-admin/admin-ajax.php...

CVE-2017-15811: Improper Neutralization of Input During Web Page Generation

The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assetsurl parameter in assets/dialog.php, exploitable via wp-admin/admin-ajax.php...

WordPress Polls 1.2.4 SQL Injection

Exploit Title :WordPress Polls plugin1.2.4 SQL Injection vulnerability Author : Manish Kishan Tanwar AKA error1046 https://twitter.com/IndiShell1046 Date : 22/10/2017 Vulnerable version: 1.2.4 Download Link : https://downloads.wordpress.org/plugin/polls-widget.1.2.4.zip Love to : zero cool,Team...

CVE-2015-7806

Eval injection vulnerability in the fmsaveHelperGatherItems function in ajax.php in the Form Manager plugin before 1.7.3 for WordPress allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2015-7806

The CVE-2015-7806 issue affects the WordPress Form Manager plugin (prior to 1.7.3). The vulnerability is in the fm_saveHelperGatherItems function of ajax.php, enabling remote code execution via unspecified vectors. Multiple sources confirm RCE potential, including CNVD and WPVulndB entries noting...

CVE-2015-7806: Improper Neutralization of Special Elements used in a Command

Eval injection vulnerability in the fmsaveHelperGatherItems function in ajax.php in the Form Manager plugin before 1.7.3 for WordPress allows remote attackers to execute arbitrary code via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Easy Contact Form Solution plugin before 1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value parameter in a masterresponse action to wp-admin/admin-ajax.php...

CVE-2014-7240

Cross-site scripting XSS vulnerability in the Easy Contact Form Solution plugin before 1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value parameter in a masterresponse action to wp-admin/admin-ajax.php...

CVE-2014-7240: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Easy Contact Form Solution plugin before 1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value parameter in a masterresponse action to wp-admin/admin-ajax.php...

CVE-2017-14597

AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XSS via the txtDomainName field to adminpanel/modules/pro/inc/ajax.php during addition of a domain...

CVE-2017-14597: Improper Neutralization of Input During Web Page Generation

AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XSS via the txtDomainName field to adminpanel/modules/pro/inc/ajax.php during addition of a domain...

Sql injection

SQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the watuproquestions parameter in a watuprosubmit action to wp-admin/admin-ajax.php...

CVE-2017-9834: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the watuproquestions parameter in a watuprosubmit action to wp-admin/admin-ajax.php...

Directory traversal

Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the act parameter to ajax.php...

CVE-2015-8352: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the act parameter to ajax.php...

vortexmag.net XSS vulnerability

Open Bug Bounty ID: OBB-280206 Description| Value ---|--- Affected Website:| vortexmag.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

mylefkada.gr XSS vulnerability

Open Bug Bounty ID: OBB-280205 Description| Value ---|--- Affected Website:| mylefkada.gr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

anorthosis24.net XSS vulnerability

Open Bug Bounty ID: OBB-280204 Description| Value ---|--- Affected Website:| anorthosis24.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

linuxundich.de XSS vulnerability

Open Bug Bounty ID: OBB-280170 Description| Value ---|--- Affected Website:| linuxundich.de Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

liman.az XSS vulnerability

Vulnerable URL: http://www.liman.az/wp-admin/admin-ajax.php?tdthemename=Newspaper=7.8 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 17.11.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 281602 VIP website status:| No Check liman.az S...