2323 matches found
Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_answers_by_question
The tutorquizbuildergetanswersbyquestion AJAX action from the plugin was vulnerable to UNION based SQL injection that could be exploited by students. python3 sqlmap.py -r /tutorunion.txt --dbms=mysql --technique=U -p questionid --dump Where tutorunion.txt is POST /wp-admin/admin-ajax.php HTTP/1.1...
Sql injection
wpDataTables before 3.4.1 mishandles order direction for server-side tables, aka admin-ajax.php?action=getwdtable order0dir SQL injection...
PT-2021-17125
Name of the Vulnerable Software and Affected Versions wpDataTables versions prior to 3.4.1 Description The issue is related to how wpDataTables handles order direction for server-side tables, leading to a SQL injection. This can be exploited through the "admin-ajax.php?action=get wdtable" endpoin...
CVE-2021-26754: Improper Neutralization of Special Elements used in an SQL Command
wpDataTables before 3.4.1 mishandles order direction for server-side tables, aka admin-ajax.php?action=getwdtable order0dir SQL injection...
CVE-2021-3318
attach/ajax.php in DzzOffice through 2.02.1 allows XSS via the editorid parameter...
CVE-2021-3318
attach/ajax.php in DzzOffice through 2.02.1 allows XSS via the editorid parameter...
CVE-2021-3318
attach/ajax.php in DzzOffice through 2.02.1 allows XSS via the editorid parameter...
CVE-2021-3318
CVE-2021-3318 affects DzzOffice
CVE-2021-3318
attach/ajax.php in DzzOffice through 2.02.1 allows XSS via the editorid parameter...
CVE-2021-3318
attach/ajax.php in DzzOffice through 2.02.1 allows XSS via the editorid parameter...
PT-2021-20063
Name of the Vulnerable Software and Affected Versions DzzOffice versions 2.02.1 and earlier Description The issue allows for XSS via the editorid parameter in the "attach/ajax.php" endpoint. Recommendations For DzzOffice versions 2.02.1 and earlier, as a temporary workaround, consider restricting...
CVE-2021-3318: Improper Neutralization of Input During Web Page Generation
attach/ajax.php in DzzOffice through 2.02.1 allows XSS via the editorid parameter...
Cross site scripting
A stored cross-site scripting XSS issue in Envira Gallery Lite before 1.8.3.3 allows remote attackers to inject arbitrary JavaScript/HTML code via a POST /wp-admin/admin-ajax.php request with the metatitle parameter...
CVE-2020-35581
A stored cross-site scripting XSS issue in Envira Gallery Lite before 1.8.3.3 allows remote attackers to inject arbitrary JavaScript/HTML code via a POST /wp-admin/admin-ajax.php request with the metatitle parameter...
CVE-2020-35581: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS issue in Envira Gallery Lite before 1.8.3.3 allows remote attackers to inject arbitrary JavaScript/HTML code via a POST /wp-admin/admin-ajax.php request with the metatitle parameter...
PT-2021-11808
Name of the Vulnerable Software and Affected Versions: Envira Gallery Lite versions prior to 1.8.3.3 Description: A stored cross-site scripting XSS issue allows remote attackers to inject arbitrary JavaScript/HTML code via a POST "/wp-admin/admin-ajax.php" request with the metatitle parameter...
PT-2021-14560
Name of the Vulnerable Software and Affected Versions MK-AUTH versions through 19.01 K4.9 Description The issue allows for XSS via the "admin/logs ajax.php" endpoint, specifically through the tipo parameter. An attacker can exploit this to read the centralmka2 session token cookie, which is not s...
Simple Social Buttons < 3.2.1 - Unauthenticated Reflected Cross-Site Scripting
The version 3.2.0 attempted to fix a reflected Cross-Site Scripting issue, by adding a CSRF check, which does not fully remediate it as unauthenticated users will all have the same nonce generated and valid for 12h to 24h, or 2 WP ticks. Only unauthenticated users can be attacked with this issue...
PT-2020-15379
Name of the Vulnerable Software and Affected Versions fastadmin version 1.0.0.20191212 beta fastadmin-tp6 version 1.0 Description The issue allows for SQL injection when a malicious parameter is passed in the URL /admin/ajax/weigh, after a user with administrator rights has logged in. The table...