PT-2020-19845

Name of the Vulnerable Software and Affected Versions LearnPress plugin versions 3.2.6.5 and earlier Description The issue allows any registered user to assign itself the teacher role via the "wp-admin/admin-ajax.php?action=learnpress be teacher" API endpoint without any additional permission...

CVE-2020-7916: Improper Privilege Management

beteacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role via the wp-admin/admin-ajax.php?action=learnpressbeteacher URI without any additional permission checks. Therefore, any user can change its...

CVE-2020-10196

An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrary JavaScript into existing popups via an unsecured ajax action in com/classes/Ajax.php. It is possible for an unauthenticated attacker to insert malicious JavaScript in several o...

Cross site scripting

An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrary JavaScript into existing popups via an unsecured ajax action in com/classes/Ajax.php. It is possible for an unauthenticated attacker to insert malicious JavaScript in several o...

CVE-2020-10196

An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrary JavaScript into existing popups via an unsecured ajax action in com/classes/Ajax.php. It is possible for an unauthenticated attacker to insert malicious JavaScript in several o...

CVE-2020-10196: Improper Neutralization of Input During Web Page Generation

An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrary JavaScript into existing popups via an unsecured ajax action in com/classes/Ajax.php. It is possible for an unauthenticated attacker to insert malicious JavaScript in several o...

PT-2020-7780

Name of the Vulnerable Software and Affected Versions: Netsweeper versions 3.1.x through 3.1.9 Netsweeper versions 4.0.x through 4.0.8 Netsweeper versions 4.1.x through 4.1.1 Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the PATH...

PT-2020-20425

Name of the Vulnerable Software and Affected Versions Popup Builder plugin versions 2.2.8 through 2.6.7.6 Description The issue allows for SQL injection via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable in the sgImportPopups function in sg popup ajax.php. Th...

CVE-2012-2517

Cross-site scripting XSS vulnerability in PrestaShop before 1.4.9 allows remote attackers to inject arbitrary web script or HTML via the index of the product parameter to ajax.php...

Cross site scripting

Cross-site scripting XSS vulnerability in PrestaShop before 1.4.9 allows remote attackers to inject arbitrary web script or HTML via the index of the product parameter to ajax.php...

CVE-2012-2517

Cross-site scripting XSS vulnerability in PrestaShop before 1.4.9 allows remote attackers to inject arbitrary web script or HTML via the index of the product parameter to ajax.php...

CVE-2012-2517

CVE-2012-2517 is an XSS vulnerability in PrestaShop before 1.4.9. The issue arises from unsanitized input in the POST/parameter named product[] to ajax.php , allowing remote attackers to inject arbitrary HTML/JS. Reported impact is cross-site scripting with potential execution in the administrato...

PT-2020-7205

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 1.4.9 Description The issue allows remote attackers to inject arbitrary web script or HTML via the index of the product parameter to "ajax.php" API endpoint. This is a cross-site scripting XSS issue. Recommendation...

CVE-2012-2517: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in PrestaShop before 1.4.9 allows remote attackers to inject arbitrary web script or HTML via the index of the product parameter to ajax.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the 1 sortby, 2 sortorder, 3 itemsview, 4 dir, 5 clipboardtask, 6 clipboardfiles, 7 clipboardsrc, or 8 clipboarddes...

CVE-2015-1394

Multiple cross-site scripting XSS vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the 1 sortby, 2 sortorder, 3 itemsview, 4 dir, 5 clipboardtask, 6 clipboardfiles, 7 clipboardsrc, or 8 clipboarddes...

CVE-2015-1394

The CVE-2015-1394 entry corresponds to multiple XSS vulnerabilities in the WordPress plugin Photo Gallery (before 1.2.11). The vulnerability allows remote authenticated users to inject arbitrary JavaScript/HTML via parameters (sort_by, sort_order, items_view, dir, clipboard_task, clipboard_files,...

PT-2020-7802

Name of the Vulnerable Software and Affected Versions: WordPress Photo Gallery plugin versions prior to 1.2.11 Description: The issue allows remote authenticated users to inject arbitrary web script or HTML via certain parameters in an addImages action to the "wp-admin/admin-ajax.php" API endpoin...

CVE-2015-1394: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the 1 sortby, 2 sortorder, 3 itemsview, 4 dir, 5 clipboardtask, 6 clipboardfiles, 7 clipboardsrc, or 8 clipboarddes...

Tutor LMS < 1.5.3 - Cross-Site Request Forgery (CSRF)

Tutor LMS WordPress plugin is vulnerable to Cross-Site Request Forgery CSRF attacks. As the requests for the approval and blocking of instructors are sent using the GET method, the CSRF attack to approve an attacker-controlled instructor account can be performed by having the admin visit...