CVE-2020-21667

In fastadmin-tp6 v1.0, in the file app/admin/controller/Ajax.php the 'table' parameter passed is not filtered so a malicious parameter can be passed for SQL injection...

PT-2020-15380

Name of the Vulnerable Software and Affected Versions fastadmin-tp6 version 1.0 Description The issue concerns a lack of filtering for the table parameter in the app/admin/controller/Ajax.php file, allowing a malicious parameter to be passed for SQL injection. Recommendations For fastadmin-tp6...

CVE-2020-21667: Improper Neutralization of Special Elements used in an SQL Command

In fastadmin-tp6 v1.0, in the file app/admin/controller/Ajax.php the 'table' parameter passed is not filtered so a malicious parameter can be passed for SQL injection...

Dynamic Content for Elementor < 1.9.6 - Authenticated RCE

The PHP Raw Widget https://www.dynamic.ooo/widget/php-raw/ of the Dynamic Content for Elementor plugin before 1.9.6 did not properly check for user permissions, allowing accounts with a role as low as editor to perform RCE attacks. POST /wp-admin/admin-ajax.php HTTP/1.1 Host: example.com...

Authentication flaw

An issue was discovered in SourceCodester Seat Reservation System 1.0. The file adminclass.php does not perform input validation on the username and password parameters. An attacker can send malicious input in the post request to /admin/ajax.php?action=login and bypass authentication, extract...

PT-2020-16188

Name of the Vulnerable Software and Affected Versions SourceCodester Seat Reservation System version 1.0 Description The issue concerns a lack of input validation on the username and password parameters in the admin class.php file. This allows an attacker to send malicious input in the POST reque...

Autoptimize < 2.7.7 - Authenticated Arbitrary File Upload

The aoccssimport AJAX call does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as PHP, leading to RCE. https://drive.google.com/file/d/1siZsDiJsYRCw58Ksram5zBJOVbs-Hio1/view?usp=sharing POST /wp-admin/admin-ajax.php HTTP/1...

CVE-2020-20633

ajaxpolicygenerator in admin/modules/cli-policy-generator/classes/class-policy-generator-ajax.php in GDPR Cookie Consent cookie-law-info 1.8.2 and below plugin for WordPress, allows authenticated stored XSS and privilege escalation...

CVE-2020-20633

CVE-2020-20633 affects the WordPress plugin GDPR Cookie Consent (cookie-law-info) versions 1.8.2 and earlier, via ajax_policy_generator in admin/modules/cli-policy-generator/classes/class-policy-generator-ajax.php. The vulnerability allows authenticated stored XSS and privilege escalation. The co...

CVE-2020-20633

ajaxpolicygenerator in admin/modules/cli-policy-generator/classes/class-policy-generator-ajax.php in GDPR Cookie Consent cookie-law-info 1.8.2 and below plugin for WordPress, allows authenticated stored XSS and privilege escalation...

Quiz and Survey Master < 7.0.1 - Arbitrary File Upload

This flaw made it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution. Set-up quiz that accepts file uploads, then upload file and change content-type to one set as approved. history.pushState'', '', '/' function submitRequest var xhr = new...

Newsletter < 6.8.2 - Authenticated Cross-Site Scripting (XSS)

Newsletter suffers from an Authenticated Reflected Cross-Site ScriptingXSS vulnerability via the ‘tnpcrender’ AJAX action found in newsletter/emails/emails.php. Due to how the corresponding ‘tnpcrendercallback‘ function decodes input via the ‘restoreoptionsfromrequest’ function and renders them v...

CVE-2020-13483

The Web Application Firewall in Bitrix24 through 20.0.0 allows XSS via the itemsITEMSID parameter to the components/bitrix/mobileapp.list/ajax.php/ URI...

CVE-2020-13484

Bitrix24 (up to and including 20.0.975, and earlier) is affected by an SSRF vulnerability in services/main/ajax.php?action=attachUrlPreview. The root cause is an insecure handling of an intranet URL when the destination HTML document contains a tag that is followed by an intranet URL. This allow...

PT-2020-13566

Name of the Vulnerable Software and Affected Versions Bitrix24 versions prior to 20.0.0 Description The issue concerns a security problem where an attacker can execute malicious scripts on a user's browser, potentially leading to unauthorized actions. This is achieved by exploiting the itemsITEMS...

CVE-2020-13484: Server-Side Request Forgery (SSRF)

Bitrix24 through 20.0.975 allows SSRF via an intranet IP address in the services/main/ajax.php?action=attachUrlPreview url parameter, if the destination URL hosts an HTML document containing '...

PT-2020-13567

Name of the Vulnerable Software and Affected Versions Bitrix24 versions prior to 20.0.976 Description The issue allows for Server-Side Request Forgery SSRF via an intranet IP address in the "services/main/ajax.php?action=attachUrlPreview" API endpoint, specifically through the url parameter. This...

CVE-2020-13483: Improper Neutralization of Input During Web Page Generation

The Web Application Firewall in Bitrix24 through 20.0.0 allows XSS via the itemsITEMSID parameter to the components/bitrix/mobileapp.list/ajax.php/ URI...

CVE-2020-14962

Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Title aka imageTitle or Caption aka description field of an image to wp-admin/admin-ajax.php...

Cross site scripting

Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Title aka imageTitle or Caption aka description field of an image to wp-admin/admin-ajax.php...