PT-2023-13605 · Ernest Marcinko · Ajax Search Lite

Name of the Vulnerable Software and Affected Versions: Ernest Marcinko Ajax Search Lite plugin versions = 4.10.3 Description: The issue is related to the exposure of sensitive information to unauthorized actors. Recommendations: For Ernest Marcinko Ajax Search Lite plugin versions = 4.10.3, updat...

[SECURITY] Fedora 38 Update: guacamole-server-1.5.0-2.fc38

Guacamole is an HTML5 remote desktop gateway. Guacamole provides access to desktop environments using remote desktop protoc ols like VNC and RDP. A centralized server acts as a tunnel and proxy, allowing access to multiple desktops through a web browser. No browser plugins are needed, and no clie...

WP Basic Elements <= 5.2.15 - Cross-Site Request Forgery (CSRF)

The plugin does not protect its wpbesavesettings ajax actions against CSRF attacks, allowing an unauthenticated attacker to update the plugin settings by tricking a logged in admin to submit a crafted request...

WordPress Ajax Load More Plugin < 5.6.0.3 is vulnerable to Cross Site Scripting (XSS)

Software Ajax Load More Type Plugin Vulnerable versions 5.6.0.3 Fixed in 5.6.0.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4466 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 33d2d66c78ff Credits Lana Codes Requir...

CVE-2023-25207

PrestaShop dpdfrance 6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php...

CVE-2023-0037

The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2023-0477

The Auto Featured Image Auto Post Thumbnail WordPress plugin before 3.9.16 includes an AJAX endpoint that allows any user with at least Author privileges to upload arbitrary files, such as PHP files. This is caused by incorrect file extension validation...

CVE-2023-0477

The Auto Featured Image Auto Post Thumbnail WordPress plugin before 3.9.16 includes an AJAX endpoint that allows any user with at least Author privileges to upload arbitrary files, such as PHP files. This is caused by incorrect file extension validation...

CVE-2023-0477 Auto Featured Image < 3.9.16 - Author+ Arbitrary File Upload

The Auto Featured Image Auto Post Thumbnail WordPress plugin before 3.9.16 includes an AJAX endpoint that allows any user with at least Author privileges to upload arbitrary files, such as PHP files. This is caused by incorrect file extension validation...

bumsys SQL注入漏洞

bumsys is an open source project called Business Management System by unilogies individual developers. unilogies bumsys version before v2.0.2 has a SQL injection vulnerability , the vulnerability stems from core/ajax/ajaxdata.php in the SQL injection...

CVE-2023-25207

PrestaShop dpdfrance 6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php...

PT-2023-16932 · Unknown · Sourcecodester Online Pizza Ordering System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Pizza Ordering System version 1.0 Description: A critical issue was found in the system, affecting an unknown functionality of the file /admin/ajax.php. The manipulation of the username argument leads to SQL injection...

CVE-2023-1336

The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check on the ajaxdeactivate function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to...

CVE-2023-1336 RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'ajax_deactivate'

The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check on the ajaxdeactivate function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to...

Cross-site Scripting in django-ajax-utilities

A vulnerability was found in Mobile Vikings Django AJAX Utilities and classified as problematic. This issue affects the function Pagination of the file djangoajax/static/ajax-utilities/js/pagination.js of the component Backslash Handler. The manipulation of the argument url leads to cross site...

GHSA-P4G9-C9QR-WMG5 Cross-site Scripting in django-ajax-utilities

A vulnerability was found in Mobile Vikings Django AJAX Utilities and classified as problematic. This issue affects the function Pagination of the file djangoajax/static/ajax-utilities/js/pagination.js of the component Backslash Handler. The manipulation of the argument url leads to cross site...

CVE-2017-20182

A vulnerability was found in Mobile Vikings Django AJAX Utilities up to 1.2.1 and classified as problematic. This issue affects the function Pagination of the file djangoajax/static/ajax-utilities/js/pagination.js of the component Backslash Handler. The manipulation of the argument url leads to...

CVE-2017-20182

A vulnerability was found in Mobile Vikings Django AJAX Utilities up to 1.2.1 and classified as problematic. This issue affects the function Pagination of the file djangoajax/static/ajax-utilities/js/pagination.js of the component Backslash Handler. The manipulation of the argument url leads to...

Cross site scripting

A vulnerability was found in Mobile Vikings Django AJAX Utilities up to 1.2.1 and classified as problematic. This issue affects the function Pagination of the file djangoajax/static/ajax-utilities/js/pagination.js of the component Backslash Handler. The manipulation of the argument url leads to...

CVE-2017-20182 Mobile Vikings Django AJAX Utilities Backslash pagination.js Pagination cross site scripting

A vulnerability was found in Mobile Vikings Django AJAX Utilities up to 1.2.1 and classified as problematic. This issue affects the function Pagination of the file djangoajax/static/ajax-utilities/js/pagination.js of the component Backslash Handler. The manipulation of the argument url leads to...