9890 matches found
CVE-2020-9340
fauzantrif eLection 2.0 has SQL Injection via the admin/ajax/opkandidat.php id parameter...
CVE-2020-9340
fauzantrif eLection 2.0 has SQL Injection via the admin/ajax/opkandidat.php id parameter...
Sql injection
fauzantrif eLection 2.0 has SQL Injection via the admin/ajax/opkandidat.php id parameter...
CVE-2020-9340
fauzantrif eLection 2.0 has SQL Injection via the admin/ajax/opkandidat.php id parameter...
CVE-2020-9340
CVE-2020-9340 affects fauzantrif eLection 2.0, a web-based election system. The vulnerability is an SQL Injection in the admin/ajax/op_kandidat.php id parameter, enabling manipulation of the backend SQL query. CVSS metrics indicate a network-accessible flaw with low initial complexity and no auth...
CVE-2020-9340
fauzantrif eLection 2.0 has SQL Injection via the admin/ajax/opkandidat.php id parameter. Recent assessments: J3rryBl4nks at March 09, 2020 9:27pm UTC reported: This is an authenticated SQL Injection that should lead to a reverse shell. It’s very easy to identify, and to exploit. The value is low...
Netsweeper Cross-Site Scripting Vulnerability (CNVD-2020-10711)
Netsweeper is a Web content filtering solution from Netsweeper Canada. A cross-site scripting vulnerability exists in the webadmin / policy / grouptableajax.php file in versions of Netsweeper prior to 3.1.10, which stems from a lack of proper validation of client-side data by the WEB application...
CVE-2019-11215
In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitrary code can be accomplished by calling ajax.dataloader with a maliciously crafted payload. Many conditions can place the configuration file into a writable state: during installation; during...
Race condition
In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitrary code can be accomplished by calling ajax.dataloader with a maliciously crafted payload. Many conditions can place the configuration file into a writable state: during installation; during...
Critical WordPress Plugin Bug Afflicts 700K Sites
A popular WordPress plugin, which helps make websites compliant with the General Data Protection Regulation GDPR, has issued fixes for a critical flaw. If exploited, the vulnerability could enable attackers to modify content or inject malicious JavaScript code into victim websites. The plugin, GD...
CVE-2020-8804
SuiteCRM through 7.11.10 allows SQL Injection via the SOAP API, the EmailUIAjax interface, or the MailMerge module...
GDPR Cookie Consent < 1.8.3 - Improper Access Controls
Improper Access Controls issue in the clipolicygenerator AJAX call which could allow an authenticated user with low privileges such as a subscriber to: - Change the status of any post/page from published to draft, removing them from the frontend of the blog. - Put a payload in the content of one...
CVE-2019-20059
paymentmanage.ajax.php and various manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.4 directly insert values from the sSortDir0 parameter into a SQL string. This allows an attacker to inject their own SQL and manipulate the query, typically extracting data from the database, aka SQL...
WordPress Plugin LearnDash LMS 3.1.2 - Reflective Cross-Site Scripting
Exploit Title: LearnDash WordPress LMS Plugin 3.1.2 - Reflective Cross-Site Scripting Date: 2020-01-14 Vendor Homepage: https://www.learndash.com Vendor Changelog: https://learndash.releasenotes.io/release/uCskc-version-312 Exploit Author: Jinson Varghese Behanan Author Advisory:...
Security Bulletin: JavaScript vulnerability affects IBM Sterling B2B Integrator (CVE-2008-7220)
Summary An unspecified error in the Prototype JavaScript framework prototype.js, as used in multiple products, could allow a remote attacker to conduct cross-site Ajax requests using unknown attack vectors. Note: This vulnerability affects the ajax based manager interface, ajamdemo.html, in certa...
wpCentral < 1.4.8 - Privilege Escalation
There’s a vulnerability that allows anyone who is logged in with any user role to escalate their privilege, or alter/upload any file, or adjust any plugin and interact with the site in many other ways. PoC In wpcentral.php, AJAX actions are registered. However, it's only checking whether or not t...
wpCentral < 1.4.8 - Privilege Escalation
There’s a vulnerability that allows anyone who is logged in with any user role to escalate their privilege, or alter/upload any file, or adjust any plugin and interact with the site in many other ways. In wpcentral.php, AJAX actions are registered. However, it's only checking whether or not the...
CVE-2019-19835
SSRF in AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote denial of service via the server attribute to the tools/rcmdstat.jsp URI...
PT-2020-6770 · Unknown · Centos Web Panel
Name of the Vulnerable Software and Affected Versions: CentOS Web Panel versions cwp-e17.0.9.8.923 Description: The issue is related to the implementation of the ajax mod security.php script in CentOS Web Panel, where the archivo parameter does not properly neutralize special elements in...