PT-2023-13983 · WordPress · Wordpress Filter Gallery Plugin

Name of the Vulnerable Software and Affected Versions: WordPress Filter Gallery Plugin version 0.1.5 and earlier Description: The WordPress Filter Gallery Plugin does not properly escape the filters passed in the ufg gallery filters ajax action before outputting them on the page. This allows a hi...

PT-2023-7671 · WordPress · Cryptocurrency Widgets Pack

Name of the Vulnerable Software and Affected Versions: Cryptocurrency Widgets Pack WordPress plugin versions prior to 2.0 Description: The issue is related to a lack of sanitization and escaping of some parameters before using them in SQL statements via an AJAX action. This can lead to SQL...

PT-2023-14110 · WordPress · Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce WordPress plugin versions prior to 2.8.5 Description: The issue concerns the Welcart e-Commerce WordPress plugin, which does not validate user input before using it to output the content of a file via an AJAX action availab...

VulnCheck KEV: CVE-2016-10972

The newspaper theme before 6.7.2 for WordPress has a lack of options access control via tdajaxupdatepanel...

The vulnerability of the FsCreateDir function in the Ajax web interface for managing WLAN client software Hirschmann BAT-C2 allows a hacker to execute arbitrary commands.

The vulnerability of the FsCreateDir function in the Ajax web interface for managing WLAN client software Hirschmann BAT-C2 is related to insufficient checking of arguments passed in the command. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using the dir...

CBX Petition for WordPress <= 1.0.3 - Unauthenticated SQLi

The plugin does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. PoC 1. Create and publish a new petition. 2. Invoke the following curl command, with the nonce in place, to induce a...

CVE-2022-4117

The IWS WordPress plugin through 1.0 does not properly escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection...

CVE-2022-4047

The Return Refund and Exchange For WooCommerce WordPress plugin before 4.0.9 does not validate attachment files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files such as PHP and lead to RCE...

CVE-2022-4117

The IWS WordPress plugin through 1.0 does not properly escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection...

Design/Logic Flaw

The Return Refund and Exchange For WooCommerce WordPress plugin before 4.0.9 does not validate attachment files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files such as PHP and lead to RCE...

CVE-2022-4117 IWS - Geo Form Fields <= 1.0 - Unauthenticated SQLi

The IWS WordPress plugin through 1.0 does not properly escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection...

PT-2022-25394 · WordPress · The Return Refund/Exchange For Woocommerce

Name of the Vulnerable Software and Affected Versions: Return Refund and Exchange For WooCommerce WordPress plugin versions prior to 4.0.9 Description: The issue concerns the lack of validation for attachment files uploaded via an AJAX action. This action is accessible to unauthenticated users,...

PT-2022-7110 · Sangoma · Freepbx

Name of the Vulnerable Software and Affected Versions: FreePBX cdr versions 14.0 through 14.0.5.20 Description: The issue is related to the ajaxHandler function in the ucp/Cdr.class.php file of the FreePBX web interface, which fails to protect against SQL query structure attacks. This can allow a...

Events Made Easy < 2.3.17 - Subscriber+ Unauthorised AJAX Calls

The plugin does not have authorisation in some AJAX actions, allowing any authenticated users, such as subscriber, to call them...

CVE-2022-3794

The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various AJAX actions in versions up to, and including, 2.5.6. Authenticated users can use an easily available nonce value to create header templates and make additional changes to the site, as the plugin does not...

CVE-2022-3794

The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various AJAX actions in versions up to, and including, 2.5.6. Authenticated users can use an easily available nonce value to create header templates and make additional changes to the site, as the plugin does not...

Authorization

The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various AJAX actions in versions up to, and including, 2.5.6. Authenticated users can use an easily available nonce value to create header templates and make additional changes to the site, as the plugin does not...

CVE-2022-3794 Jeg Elementor Kit <= 2.5.6 - Authorization Bypass

The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various AJAX actions in versions up to, and including, 2.5.6. Authenticated users can use an easily available nonce value to create header templates and make additional changes to the site, as the plugin does not...

CVE-2022-3794

Summary: CVE-2022-3794 affects the WordPress plugin Jeg Elementor Kit up to version 2.5.6. The issue is an authorization bypass in various AJAX actions where an authenticated user can exploit an easily available nonce value due to missing capability checks. What is affected: Jeg Elementor Kit plu...

PT-2022-24165 · WordPress · Jeg Elementor Kit

Name of the Vulnerable Software and Affected Versions: Jeg Elementor Kit plugin for WordPress versions up to, and including, 2.5.6 Description: The issue concerns an authorization bypass in various AJAX actions. Authenticated users can exploit an easily available nonce value to create header...