Cross-site request forgery vulnerability in phpMyFaq admin/ajax.config.php file

phpMyFAQ is phpMyFAQ team developed a set of open source fully database-driven FAQ question and answer system . The system supports multiple languages, multiple databases, etc., and includes modules such as content management system and community. A cross-site request forgery vulnerability exists...

CSRF Protection Bypass in Ruby on Rails

Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery CSRF attacks via forged 1 AJAX or 2 API requests that...

Cross-Site Request Forgery (CSRF)

Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery CSRF attacks via forged 1 AJAX or 2 API requests that...

Cross site scripting

Cross-site scripting XSS vulnerability in actions.hsp in the Ajax WebMail interface in AXIGEN Mail Server before 9.0 allows remote attackers to inject arbitrary web script or HTML via an email attachment...

CVE-2015-5379

Cross-site scripting XSS vulnerability in actions.hsp in the Ajax WebMail interface in AXIGEN Mail Server before 9.0 allows remote attackers to inject arbitrary web script or HTML via an email attachment...

WordPress: Unauthenticated hidden groups disclosure via Ajax groups search

Note: this issue was previously submitted to [email protected], because I did not have the rep to submit it here. That was cleared up with HackerOne, so I am now submitting the issue here, at @aaroncampbell's direction. Summary It is possible for an unauthenticated user to view the title,...

CVE-2017-15811

The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assetsurl parameter in assets/dialog.php, exploitable via wp-admin/admin-ajax.php...

Cross site request forgery (csrf)

In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php...

Cross site request forgery (csrf)

In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery CSRF in admin/ajax.attachment.php and admin/att.main.php...

vivastreet.com XSS vulnerability

Open Bug Bounty ID: OBB-359751 Description| Value ---|--- Affected Website:| vivastreet.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

bolsamania.com XSS vulnerability

Vulnerable URL: http://www.bolsamania.com?section=ajax=quotes/common/v1/graph&dato1;=GB0001383545:FTSE-100:I:232:50102046=LIN001=1=uk=FTSE+100time=60=confirm/openbugbounty/...

CVE-2014-8087

Cross-site scripting XSS vulnerability in the post highlights plugin before 2.6.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the txt parameter in a headline action to ajax/phsave.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the post highlights plugin before 2.6.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the txt parameter in a headline action to ajax/phsave.php...

CVE-2014-8087

CVE-2014-8087 corresponds to a stored XSS in the WordPress Post Highlights plugin (versions before 2.6.1). The vulnerability allows an attacker to inject arbitrary script/HTML via the txt parameter used in a headline action to ajax/ph_save.php. Public records consistently cite the affected compon...

CVE-2014-8087

Cross-site scripting XSS vulnerability in the post highlights plugin before 2.6.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the txt parameter in a headline action to ajax/phsave.php...

Ajax Quiz by Webkul,2.0,SQL Injection

Ajax Quiz by Webkul, 2.0 and previous, SQL Injection Resolution: update to version 2.1 Update notice: https://store.webkul.com/AjaxQuiz.html...

siamphone.com XSS vulnerability

Vulnerable URL: http://www.siamphone.com/search//ajaxsearchmodel.php?jsoncallback=prompt/OPENBUGBOUNTY/...

Grab: www.drivegrab.com SQL injection

Summary: The website uses a WordPress plugin called Formidable Pro. I found an SQL injection in the plugin code. Description: The plugin allows the site admin to create forms to be filled by users. For this end it implements some AJAX functions, including one to preview or actually just view a...

Legal Robot: Improper Implementation of Password strength checker

Hi, I have seen Improper Implementation of Password strength checker for registration and login page. Once it suggest complex password, one can alter the password but the complexity remain the same Its usually related to Ajax or auto-reload implementation. PoC ------------------------------------...

diariojudio.com XSS vulnerability

Vulnerable URL: http://diariojudio.com/wp-admin/admin-ajax.php?tdthemename=Newspaper=8.1 Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 289299 VIP website status:| No Coordinated Disclosure Timeline: Description...