133 matches found
PT-2024-16507 · Unknown · Phpgurukul Online Shopping Portal
Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Shopping Portal version 2.0 Description: A vulnerability was found in the PHPGurukul Online Shopping Portal, allowing for cross-site scripting XSS attacks. The issue is related to an unknown function in the file...
SourceCodester Tracking Monitoring Management System 跨站请求伪造漏洞
SourceCodester Tracking Monitoring Management System is a monitoring management system from SourceCodester, Inc. A cross-site request forgery vulnerability exists in the SourceCodester Tracking Monitoring Management System version 1.0, which is caused by the /ajax.php file containing a cross-site...
PT-2024-38291 · Sourcecodester · Sourcecodester Tracking Monitoring Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Tracking Monitoring Management System version 1.0 Description: A problematic issue has been found in the system, affecting an unknown part of the file /ajax.php. This issue leads to cross-site request forgery and can be initiat...
CVE-2024-7169
A vulnerability classified as problematic has been found in SourceCodester School Fees Payment System 1.0. This affects an unknown part of the file /ajax.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to th...
PT-2024-38131 · Unknown · Sourcecodester School Fees Payment System
Name of the Vulnerable Software and Affected Versions: SourceCodester School Fees Payment System version 1.0 Description: A problematic issue has been found in the system, affecting an unknown part of the file /ajax.php. This issue leads to cross-site request forgery and can be initiated remotely...
PT-2024-28829 · Unknown · Sourcecodester Library Management System
Name of the Vulnerable Software and Affected Versions: Sourcecodester Simple Library Management System version 1.0 Description: A SQL injection issue was discovered due to insufficient validation of user input for the username parameter in the "ajax.php" file. This allows attackers to inject...
CVE-2024-4797
A vulnerability was found in Campcodes Online Laundry Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /ajax.php. The manipulation of the argument name/customername/username leads to cross site scripting. The attack can be initiated...
PT-2024-32920 · Campcodes · Campcodes Online Laundry Management System
Name of the Vulnerable Software and Affected Versions: Campcodes Online Laundry Management System version 1.0 Description: A problem was found in the system, affecting the /ajax.php file. The issue is related to the manipulation of the customer name/username argument, leading to cross-site...
CVE-2024-3719
A vulnerability, which was classified as critical, was found in Campcodes House Rental Management System 1.0. This affects an unknown part of the file ajax.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclos...
PT-2024-9989 · WordPress · Vibebp
Name of the Vulnerable Software and Affected Versions: VibeBP versions 1.9.9.4.1 and earlier Description: The issue is related to an Incorrect Privilege Assignment vulnerability, which allows Privilege Escalation. This vulnerability is associated with the vibebp register user function in the...
CVE-2024-29810
The thumburl parameter of the AJAX call to the editimagebwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the thumburl parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The...
House Rental Management System SQL注入漏洞
House Rental Management System is a house rental management system by Carlo Montero Personal Developer. A SQL injection vulnerability exists in Campcodes House Rental Management System version 1.0, which originates from a SQL injection vulnerability in the parameter username in the file ajax.php...
UCMS Cross-Site Scripting Vulnerability
UCMS is a content management system written in PHP. A cross-site scripting vulnerability exists in UCMS version 1.4.7, which originates from an unknown function in the file ajax.php?do=strarraylist, which leads to cross-site scripting via the parameter strdefault...
CVE-2023-3802
A vulnerability was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /Controller/Ajaxfileupload.ashx. The manipulation of the argument file leads to unrestricted upload. The...
PT-2023-22794 · Yfcmf · Yfcmf
Name of the Vulnerable Software and Affected Versions: YFCMF versions up to 3.0.4 Description: A problematic issue affects the processing of the file app/admin/controller/Ajax.php. The manipulation of the controllername argument leads to path traversal, allowing an attacker to access files using...
CVE-2023-2565
A vulnerability has been found in SourceCodester Multi Language Hotel Management Software 1.0 and classified as problematic. This vulnerability affects unknown code of the file ajax.php of the component POST Parameter Handler. The manipulation of the argument complainttype with the input...
Contao 路径遍历漏洞
Contao is an open source content management system CMS developed using PHP. The system supports search engines, rights management and CSS frameworks. A path traversal vulnerability exists in Contao versions prior to 4.9.40, 4.13.21, and 5.1.4. An attacker exploiting this vulnerability could list...
PT-2023-18281 · Sourcecodester · Sourcecodester Complaint Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Complaint Management System version 1.0 Description: A problematic issue was found in the SourceCodester Complaint Management System, affecting some unknown functionality of the file...
Waiting: One-click Countdowns <= 0.6.2 - Subscriber+ SQLi
The plugin does not properly sanitise and escape the pbcdownmetaid parameter before using it in a SQL statement via the pbcsavedowns AJAX action, leading to a SQL injection exploitable by any authenticated users, such as subscriber Run the below command in the developer console of the web browser...
