WordPress SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin Photo Gallery by Ays - Responsive Image Gallery A SQL injection vulnerability exist...

WordPress SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in WordPress plugin Ays- Responsive Slider and Carousel prior t...

WordPress SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the WordPress plugin FAQ Builder AYS prior to version 1.3.6,...

WordPress Photo Gallery by Ays plugin <= 4.4.3 - Authenticated Blind SQL Injection (SQLi) vulnerability

Authenticated Blind SQL Injection SQLi vulnerability discovered by To Quang Duong in WordPress Photo Gallery by Ays plugin versions = 4.4.3. Solution Update the WordPress Photo Gallery by Ays plugin to the latest available version at least 4.4.4...

Image Slider by Ays - Responsive Slider and Carousel < 2.5.0 - Authenticated Blind SQL Injection

The getsliders function in the plugin did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard SQLMAP: python sqlmap.py -r r.txt -p orderby --level 5 --risk 3 --dbms MySQL...

Multiple Plugins from AYS Pro - Reflected Cross-Site Scripting (XSS)

The plugins did not properly sanitise and escape some GET parameters before outputting them back in attributes, leading to reflected Cross-Site Scripting issues which will be executed in the context of a logged in administrator...

Multiple Plugins from AYS Pro - Reflected Cross-Site Scripting (XSS)

The plugins did not properly sanitise and escape some GET parameters before outputting them back in attributes, leading to reflected Cross-Site Scripting issues which will be executed in the context of a logged in administrator PoC...

Image Slider by Ays - Responsive Slider and Carousel < 2.5.0 - Authenticated Blind SQL Injection

The getsliders function in the plugin did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard PoC SQLMAP: python sqlmap.py -r r.txt -p orderby --level 5 --risk 3 --dbms MySQ...

WordPress Image Slider by Ays plugin <= 2.4.9 - Authenticated Blind SQL Injection (SQLi) vulnerability

Authenticated Blind SQL Injection SQLi vulnerability discovered by To Quang Duong in WordPress Image Slider by Ays plugin versions = 2.4.9. Solution Update the WordPress Image Slider by Ays plugin to the latest available version at least 2.5.0...

WordPress FAQ Builder AYS plugin <= 1.3.5 - Authenticated Blind SQL Injection (SQLi) vulnerability

Authenticated Blind SQL Injection SQLi vulnerability discovered by To Quang Duong in WordPress FAQ Builder AYS plugin versions = 1.3.5 Solution Update the WordPress FAQ Builder AYS plugin to the latest available version at least 1.3.6...

Photo Gallery by Ays - Responsive Image Gallery < 4.4.4 - Authenticated Blind SQL Injections

The getgallerycategories and getgalleries functions in the plugin did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard SQLMAP: python sqlmap.py -r r.txt -p orderby --leve...

Ayision Ays-WR01 Cross-Site Scripting Vulnerability

The Ayision Ays-WR01 is a wireless repeater from Ayision China. A cross-site scripting vulnerability exists in the basic repeater configuration in the Ayision Ays-WR01 v28K.RPT.20161224 release. The vulnerability stems from a network system or product performing operations on memory without...

Ayision Ays-WR01 Cross-Site Scripting Vulnerability

The Ayision Ays-WR01 is a wireless repeater from Ayision China. A cross-site scripting vulnerability exists in the wireless settings in the Ayision Ays-WR01 v28K.RPT.20161224 release. The vulnerability stems from a network system or product performing operations on memory without properly...

CVE-2019-19514

Ayision Ays-WR01 v28K.RPT.20161224 devices allow stored XSS in basic repeater settings via an SSID...

CVE-2019-19514

Ayision Ays-WR01 v28K.RPT.20161224 devices allow stored XSS in basic repeater settings via an SSID...

CVE-2019-19515

Ayision Ays-WR01 v28K.RPT.20161224 devices allow stored XSS in wireless settings...

Cross site scripting

Ayision Ays-WR01 v28K.RPT.20161224 devices allow stored XSS in basic repeater settings via an SSID...

Cross site scripting

Ayision Ays-WR01 v28K.RPT.20161224 devices allow stored XSS in wireless settings...

CVE-2019-19515

Ayision Ays-WR01 v28K.RPT.20161224 devices allow stored XSS in wireless settings...

CVE-2019-19515

CVE-2019-19515 concerns Ayision Ays-WR01 devices with the v28K.RPT.20161224 release, where a stored cross-site scripting (XSS) vulnerability exists in wireless settings. Connected sources describe the underlying issue as operations on memory without proper data validation, leading to improper rea...