WordPress plugin Images Optimize and Upload CF7 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal vulnerability exists ...

PT-2022-14027 · Unknown · Jupiter Theme +1

Name of the Vulnerable Software and Affected Versions: JupiterX Theme versions =2.0.6 JupiterX Core Plugin versions =2.0.6 Description: The issue allows any logged-in user to access functions registered in "lib/api/api/ajax.php", including jupiterx api ajax actions. This grants the ability to...

WordPress Support Board plugin跨站请求伪造漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports personal blogging sites on servers with PHP and MySQL. cross-site request forgery vulnerability exists in versions of the WordPress Support Board plugin prior to 3.3.6, whic...

CVE-2021-24823

The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php file, which could allow attackers to make logged in users do unwanted actions. For example, make an admin delete arbitrary files...

WordPress plugin Support Board 跨站请求伪造漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports personal blogging sites on servers with PHP and MySQL. cross-site request forgery vulnerability exists in versions of the WordPress Support Board plugin prior to 3.3.6, whic...

Chamilo LMS 跨站脚本漏洞

Chamilo LMS is an open source online learning and collaboration system from the Chamilo Association. The system supports the creation of instructional content, remote training, and online question and answer sessions. Chamilo LMS suffers from a cross-site scripting vulnerability that allows a...

The vulnerability in the “main/inc/ajax/model.ajax.php” file of the Chamilo e-learning and content management system allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability in the main/inc/ajax/model.ajax.php file of the Chamilo e-learning and content management system relates to the lack of protection for SQL query structures. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of t...

elFinder 安全漏洞

elFinder is a set of Drupal-based platform , open source AJAX file manager . The product provides multiple file uploads, image scaling and other features. A security vulnerability exists in ElFinder 2.1.47 and earlier versions, which stems from a command injection vulnerability in the program's P...

CentOS Web Panel Operating System Command Injection Vulnerability (CNVD-2020-44595)

CentOS Web Panel CWP is a free web hosting control panel. An operating system command injection vulnerability exists in the ajaxphppecl.php file in the CentOS Web Panel cwp-el7-0.9.8.891 release, which stems from failure to properly validate user-supplied strings before executing system calls. An...

CVE-2020-15712

rConfig 3.9.5 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a crafted request to the ajaxGetFileByPath.php script containing hexadecimal encoded "dot dot" sequences %2f..%2f in the path parameter to view arbitrary files on the system...

CVE-2020-12103

In Tiny File Manager 2.4.1 there is a vulnerability in the ajax file backup copy functionality which allows authenticated users to create backup copies of files with .bak extension outside the scope in the same directory in which they are stored...

PT-2019-7053 · WordPress · Cforms2

Name of the Vulnerable Software and Affected Versions: cforms2 plugin versions prior to 13.2 Description: The issue concerns a cross-site scripting XSS problem in the lib ajax.php file of the cforms2 plugin for WordPress. Recommendations: For versions prior to 13.2, update to version 13.2 or late...

dotCMS 5.1.1 - HTML Injection Vulnerability

Exploit for jsp platform in category web applications Exploit Title: dotCMS 5.1.1 - HTML Injection Exploit Author: Ismail Tasdelen Vendor Homepage: https://dotcms.com/ Software Link: https://github.com/dotCMS Software: dotCMS Product Version: 5.1.1 Vulernability Type: Code Injection Vulenrability...

CVE-2018-15818

An issue was discovered in Repute ARForms 3.5.1 and prior. An attacker is able to delete any file on the server with web server privileges by sending a malicious request to admin-ajax.php...

tsv-lindewitt.de XSS vulnerability

Open Bug Bounty ID: OBB-637592 Description| Value ---|--- Affected Website:| tsv-lindewitt.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Other Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

WordPress weblizar-pinterest-feeds plugin cross-site request forgery vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site. weblizar-pinterest-feeds plugin is used in one of the plugin for displaying Pinterest data. A cross-site request...

diariojudio.com XSS vulnerability

Vulnerable URL: http://diariojudio.com/wp-admin/admin-ajax.php?tdthemename=Newspaper=8.1 Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 289299 VIP website status:| No Coordinated Disclosure Timeline: Description...

SQL Injection Vulnerability in UCMS 'ajax.php' File

UCMS is a simple open source content management system. A SQL injection vulnerability exists in the UCMS 'ajax.php' file, which can be exploited by attackers to obtain sensitive information about the database...

CVE-2017-11466

Arbitrary file upload vulnerability in com/dotmarketing/servlets/AjaxFileUploadServlet.class in dotCMS 4.1.1 allows remote authenticated administrators to upload .jsp files to arbitrary locations via directory traversal sequences in the fieldName parameter to servlets/ajaxfileupload. This results...

dotCMS Arbitrary File Upload Vulnerability Vulnerability

dotCMS is a content management system CMS from the United States dotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . An arbitrary file upload vulnerability exists in the com/dotmarketing/servlets/AjaxFileUploadServlet.class file in...