CampCodes Online Recruitment Management System 代码问题漏洞

CampCodes Online Recruitment Management System is a recruitment management system from CampCodes Philippines, Inc. A code issue vulnerability exists in Campcodes Online Recruitment Management System version 1.0 due to an unrestricted upload as a result of incorrect manipulation of the parameter i...

CVE-2025-4775

The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-button-label HTML attribute in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress Ajax Load More plugin <= 7.4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Ajax Load More versions = 7.4.0.1...

CVE-2025-4775 WordPress Infinite Scroll – Ajax Load More <= 7.4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting

The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-button-label HTML attribute in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for...

Webkul QloApps 注入漏洞

Webkul QloApps is a hotel reservation management software from Webkul. An injection vulnerability exists in Webkul QloApps version 1.6.1, which stems from SQL injection due to incorrect manipulation of the parameter packItself in the file /admin/ajaxproductslist.php...

WordPress plugin WordPress Infinite Scroll - Ajax Load More Cross Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin WordPress Infinite...

CVE-2025-24388

OTRS Administrative and Agent Interfaces are affected by CVE-2025-24388. A parameter injection vulnerability exists for an authenticated admin or agent user in versions before OTRS 8, impacting OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X and ((OTRS)) Community Edition 6.0.x. The issue stems from pa...

CVE-2025-4200

The Zagg - Electronics & Accessories WooCommerce WordPress Theme theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.1 via the loadview function that is called via at least three AJAX actions: 'loadmorepost', 'loadshop', and 'loadmoreproduct. This...

CVE-2025-4200

CVE-2025-4200 (Zagg theme

PT-2025-25471 · Zagg · Zagg

Name of the Vulnerable Software and Affected Versions: Zagg - Electronics & Accessories WooCommerce WordPress Theme versions up to, and including, 1.4.1 Description: The issue allows unauthenticated attackers to include and execute arbitrary files on the server via the load view function, which i...

WordPress Traffic Monitor 3.2.2 Unauthenticated Bot Logging Disable

This repository features a Nuclei template specifically designed to detect an unauthenticated bot logging disable vulnerability in the Traffic Monitor WordPress plugin. This issue allows unauthenticated attackers to remotely disable bot logging via a vulnerable AJAX action. It affects versions up...

Malicious code in ac-ajax (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6104c32d3a2365656156e83b9d2484fa03258db82702dc5c8e772a97ee067968 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4922 Malicious code in ac-ajax (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6104c32d3a2365656156e83b9d2484fa03258db82702dc5c8e772a97ee067968 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-4840

The inprosysmedia-likes-dislikes-post WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2025-4840 Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection

The inprosysmedia-likes-dislikes-post WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2025-5586

The WordPress Ajax Load More and Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

CVE-2025-1778

The Art Theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'artthemethemeoptionrestore' AJAX function in all versions up to, and including, 3.12.2.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delet...

VulnCheck KEV: CVE-2020-22208

SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajaxstreet.php...

CVE-2025-5586 WordPress Ajax Load More and Infinite Scroll <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

The WordPress Ajax Load More and Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

CVE-2025-4578

The File Provider WordPress plugin through 1.2.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...