CVE-2013-7196: Undefined Security Weakness

static/ajax.php in PHPFox 3.7.3, 3.7.4, and 3.7.5 allows remote authenticated users to bypass intended "Only Me" restrictions and comment on a private publication via a request with a modified valitemid parameter for the publication...

WordPress Ajax Pagination插件'admin-ajax.php'本地文件包含漏洞

Bugtraq ID:66526 WordPress是一款内容管理系统。 由于'admin-ajax.php'脚本没有正确过滤用户提交的输入，攻击者可以利用漏洞包含本地文件，以WEB权限查看系统文件。 0 WordPress Ajax Pagination Plugin 1.1 目前没有详细解决方案： http://wordpress.org/plugins/ajax-pagination/...

PT-2014-3483

Name of the Vulnerable Software and Affected Versions Moodle versions 2.3.11 and earlier, 2.4.x through 2.4.8, 2.5.x through 2.5.4, 2.6.x through 2.6.1 Description The issue allows remote authenticated users to bypass intended access restrictions by remaining in a chat session after an...

PT-2014-2799

Name of the Vulnerable Software and Affected Versions VICIDIAL dialer versions 2.8-403a, 2.7, 2.7RC1, and earlier Description The issue concerns SQL injection vulnerabilities in the agent interface of VICIDIAL dialer. These vulnerabilities allow remote attackers to execute arbitrary SQL commands...

Cross site scripting

Cross-site scripting XSS vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ajaxnonce parameter to wp-admin/admin-ajax.php...

CVE-2013-1409

Cross-site scripting XSS vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ajaxnonce parameter to wp-admin/admin-ajax.php...

CVE-2013-1409

CVE-2013-1409 affects the WordPress CommentLuv plugin prior to 2.92.4. The vulnerability is a cross-site scripting (XSS) flaw in the _ajax_nonce parameter passed to wp-admin/admin-ajax.php, allowing an attacker to inject arbitrary script/HTML. CVSSv2 base score listed as 4.3 (Medium) with I-P imp...

CVE-2013-1409: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ajaxnonce parameter to wp-admin/admin-ajax.php...

PT-2014-2476

Name of the Vulnerable Software and Affected Versions CommentLuv plugin versions prior to 2.92.4 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the ajax nonce parameter to the "wp-admin/admin-ajax.php" API endpoint...

WordPress Zedity 2.4.0 Cross Site Scripting

============================================================== Title ...| Zedity XSS Version .| zedity.2.4.0 Date ....| 23.02.2014 Found ...| HauntIT Blog Home ....| http://wordpress.org/plugins/ ==============================================================...

CVE-2012-6624

Cross-site scripting XSS vulnerability in the SoundCloud Is Gold plugin 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the width parameter in a soundcloudisgoldplayerpreview action to wp-admin/admin-ajax.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the SoundCloud Is Gold plugin 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the width parameter in a soundcloudisgoldplayerpreview action to wp-admin/admin-ajax.php...

CVE-2012-6624

Cross-site scripting XSS vulnerability in the SoundCloud Is Gold plugin 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the width parameter in a soundcloudisgoldplayerpreview action to wp-admin/admin-ajax.php...

CVE-2012-6624

The CVE concerns the SoundCloud Is Gold WordPress plugin (v2.1) where a Cross-Site Scripting (XSS) flaw exists in the width parameter of the soundcloud_is_gold_player_preview action to wp-admin/admin-ajax.php. This allows remote attackers to inject arbitrary script/HTML in the context of affected...

CVE-2012-6624: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the SoundCloud Is Gold plugin 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the width parameter in a soundcloudisgoldplayerpreview action to wp-admin/admin-ajax.php...

PT-2014-2393

Name of the Vulnerable Software and Affected Versions SoundCloud Is Gold plugin version 2.1 for WordPress Description The issue allows remote attackers to inject arbitrary web script or HTML via the width parameter in a soundcloud is gold player preview action to the "/wp-admin/admin-ajax.php" AP...

openSIS "modname" PHP代码注入漏洞

CVECAN ID: CVE-2013-1349 openSIS是开源学生信息系统。 openSIS 5.2版本没有正确过滤ajax.php内的"modname"参数值，可导致注入和执行任意PHP代码。 0 opensis opensis 5.2 厂商补丁： opensis ------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.opensis.com/ openSIS: http://sourceforge.net/p/opensis-ce/bugs/59/ Egidio Romano:...

OpenSIS 'modname' PHP Code Execution Vulnerability

This Metasploit module exploits a PHP code execution vulnerability in OpenSIS versions 4.5 to 5.2 which allows any authenticated user to execute arbitrary PHP code under the context of the web-server user. The 'ajax.php' file calls 'eval' with user controlled data from the 'modname' parameter. Th...

Sql injection

Eval injection vulnerability in ajax.php in openSIS 4.5 through 5.2 allows remote attackers to execute arbitrary PHP code via the modname parameter...

CVE-2013-1349

OpenSIS CVE-2013-1349 affects OpenSIS 4.5–5.2. The vulnerability is in ajax.php: the parameter modname is not properly sanitized before being used in an eval call, allowing an attacker to inject and execute arbitrary PHP code. Multiple sources reference the code path through ajax.php and the modn...