YaySMTP < 2.2.1 - Subscriber+ Logs Disclosure

The plugin does not have capability check in an AJAX action, allowing any logged in users, such as subscriber to view the Logs of the plugin PoC @author : 0xshdax Rafshanzani Suhada @usage : python3 script.py http://localhost import requests, sys, re, json Setup here url = sys.argv1 headers =...

Copyright Proof <= 4.16 - Reflected Cross-Site-Scripting

The plugin does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting when a specific setting is enabled. PoC To make it easier to verify the vulnerability without the...

Malicious code in ajax-libz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d5a2556c88b49a6c9fc5d7adb34b58f54d397ece23c291ab6bf016e960798ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-918 Malicious code in ajax-googleapis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a79286735a82d77ea004ac63d7e093e57051ba3ed791eb403acc3ca5985b863c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ajax-googleapis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a79286735a82d77ea004ac63d7e093e57051ba3ed791eb403acc3ca5985b863c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-922 Malicious code in ajax-libz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d5a2556c88b49a6c9fc5d7adb34b58f54d397ece23c291ab6bf016e960798ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ajax-libs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a42a0d791115ba30e5e048f5af09cdaff93938a6ca4a25d5af7ae617df66b47 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-920 Malicious code in ajax-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 070b8379312b6676349ca70706e2c71839f85076c1fd7e29cfb56d46df1dd58e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-921 Malicious code in ajax-libs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a42a0d791115ba30e5e048f5af09cdaff93938a6ca4a25d5af7ae617df66b47 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ajax-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 070b8379312b6676349ca70706e2c71839f85076c1fd7e29cfb56d46df1dd58e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Gallery plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

The vulnerability of the __ajax_explorer.sgi file in D-Link DIR-645 router microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the ajaxexplorer.sgi file of the D-Link DIR-645 router microprogramming system is related to the failure to eliminate special elements used in the operating system’s processing of the QUERYSTRING parameter. Exploiting this vulnerability can allow an attacker to execute...

CVE-2022-1946

The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting issue...

CVE-2022-1946

The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting issue...

CVE-2022-1946

The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting issue...

CVE-2022-1946

The WordPress Gallery plugin before 2.0.0 contains a reflected Cross-Site Scripting vulnerability in which a parameter is not sanitized/escaped before being echoed in the AJAX response. The issue is exploitable via an AJAX action accessible to both unauthenticated and authenticated users, potenti...

Shareaholic < 9.7.6 - Information Disclosure

The plugin does not have proper authorisation check in one of the AJAX action, available to unauthenticated in v 9.7.5 and author+ in v9.7.5 users, allowing them to call it and retrieve various information such as the list of active plugins, various version like PHP, cURL, WP etc. PoC...

PT-2022-6290 · WordPress · Wicked Folders

Name of the Vulnerable Software and Affected Versions: Wicked Folders plugin for WordPress versions up to, and including, 2.18.16 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the ajax save state function. This allows unauthenticat...

CVE-2022-33326

Multiple command injection vulnerabilities exist in the webserver ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The...

CVE-2022-33329

Multiple command injection vulnerabilities exist in the webserver ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The /ajax/setsystime/...