CVE-2017-18604

The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request...

CVE-2017-18604

The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request...

Cross site request forgery (csrf)

The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request...

CVE-2017-18604

The CVE-2017-18604 entry concerns the WordPress plugin sitebuilder-dynamic-components (up to version 1.0). Multiple sources confirm a PHP object injection vulnerability reachable via AJAX requests, enabling an unauthenticated/vector-based impact with HIGH integrity risk (CVSS v3.1: 7.5). Affected...

CVE-2017-18604

The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request...

LibreNMS SQL Injection Vulnerability (CNVD-2019-32210)

LibreNMS is a PHP/MYSQL/SNMP-based open source monitoring tool . An SQL injection vulnerability exists in ajaxrulesuggest.php in LibreNMS 1.50.1, which can be exploited by an authenticated attacker to corrupt database queries in order to extract or manipulate data...

CVE-2018-21013

The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors involving xmlPath to wp-admin/admin-ajax.php...

Search Exclude < 1.2.4 - Arbitrary Settings Change

Unauthenticated plugin settings change via admininit Authenticated plugin settings change via AJAX...

CVE-2019-15873

The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pmtemplatepreview&html=?php substring followed by PHP code...

CVE-2019-15867

The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13 password for the slickpopupteam account, after a Subscriber calls a certain AJAX action...

Hardcoded credentials

The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13 password for the slickpopupteam account, after a Subscriber calls a certain AJAX action...

CVE-2019-15867

The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13 password for the slickpopupteam account, after a Subscriber calls a certain AJAX action...

WordPress profilegrid-user-profiles-groups-and-communities plugin code injection vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. profilegrid-user-profiles-groups-and-communities is a plugin for configuring site user permissions. A code injection vulnerability...

CVE-2019-15841

The facebook-for-woocommerce plugin before 1.9.15 for WordPress has CSRF via ajaxwooinfobannerpostclick, ajaxwooinfobannerpostxout, or ajaxfbtogglevisibility...

CVE-2019-15841

The facebook-for-woocommerce plugin before 1.9.15 for WordPress has CSRF via ajaxwooinfobannerpostclick, ajaxwooinfobannerpostxout, or ajaxfbtogglevisibility...

CVE-2019-15771

The nd-shortcodes plugin before 6.0 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...

Code injection

The nd-shortcodes plugin before 6.0 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...

CVE-2019-15774

The nd-booking plugin before 2.5 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...

CVE-2019-15773

The nd-travel plugin before 1.7 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...

Code injection

The nd-learning plugin before 4.8 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...