2325 matches found
Cross site request forgery (csrf)
MapSVG MapSVG Lite version 3.2.3 contains a Cross Site Request Forgery CSRF vulnerability in REST endpoint /wp-admin/admin-ajax.php?action=mapsvgsave that can result in an attacker can modify post data, including embedding javascript. This attack appears to be exploitable via the victim must be...
CVE-2019-1000003
MapSVG MapSVG Lite version 3.2.3 contains a Cross Site Request Forgery CSRF vulnerability in REST endpoint /wp-admin/admin-ajax.php?action=mapsvgsave that can result in an attacker can modify post data, including embedding javascript. This attack appears to be exploitable via the victim must be...
CVE-2019-1000003
MapSVG Lite 3.2.3 is affected by a CSRF in the mapsvg_save AJAX endpoint (/wp-admin/admin-ajax.php?action=mapsvg_save) that can allow an authenticated admin to modify post data (including embedded JavaScript). Exploitation requires the attacker to have an admin account and to entice the admin to ...
CVE-2019-1000003: Cross-Site Request Forgery (CSRF)
MapSVG MapSVG Lite version 3.2.3 contains a Cross Site Request Forgery CSRF vulnerability in REST endpoint /wp-admin/admin-ajax.php?action=mapsvgsave that can result in an attacker can modify post data, including embedding javascript. This attack appears to be exploitable via the victim must be...
PT-2019-11257
Name of the Vulnerable Software and Affected Versions: MapSVG Lite versions prior to 3.3.0 Description: The issue allows an attacker to modify post data, including embedding javascript, due to a Cross Site Request Forgery CSRF vulnerability in the REST endpoint...
CVE-2018-19042
The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the dirfrom and dirto parameters of an mrelocatormove action to the wp-admin/admin-ajax.php URI...
CVE-2018-19040: Improper Limitation of a Pathname to a Restricted Directory
The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocatorgetdir action to the wp-admin/admin-ajax.php URI...
PT-2019-9723
Name of the Vulnerable Software and Affected Versions Media File Manager plugin version 1.4.2 Description The issue allows for arbitrary file movement through a ../ directory traversal in the dir from and dir to parameters of an mrelocator move action to the "wp-admin/admin-ajax.php" URI...
PT-2019-9721
Name of the Vulnerable Software and Affected Versions Media File Manager plugin version 1.4.2 Description The issue allows directory listing via a ../ directory traversal in the dir parameter of an mrelocator getdir action to the "wp-admin/admin-ajax.php" URI. Recommendations For Media File Manag...
CVE-2018-19041: Improper Neutralization of Input During Web Page Generation
The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocatorgetdir action to the wp-admin/admin-ajax.php URI...
PT-2019-9722
Name of the Vulnerable Software and Affected Versions Media File Manager plugin version 1.4.2 Description The issue allows for XSS via the dir parameter of an mrelocator getdir action to the "wp-admin/admin-ajax.php" API endpoint. Recommendations For Media File Manager plugin version 1.4.2, avoid...
CVE-2019-6703
The Calmar Webmedia Total Donations plugin for WordPress (versions through 2.0.5 ) contains an incorrect access control vulnerability in migla_ajax_functions.php. Unauthenticated attackers can exploit this by sending requests to wp-admin/admin-ajax.php to trigger the miglaA_update_me action, allo...
PT-2019-18275
Name of the Vulnerable Software and Affected Versions Calmar Webmedia Total Donations plugin versions through 2.0.5 Description The issue allows unauthenticated attackers to update arbitrary WordPress option values, potentially leading to site takeover. Attackers can send requests to...
PT-2019-18082
Name of the Vulnerable Software and Affected Versions Cleanto version 5.0 Description The issue is related to SQL Injection via the service id parameter in the "assets/lib/service method ajax.php" API endpoint. Recommendations For Cleanto version 5.0, avoid using the service id parameter in the...
PT-2019-18083
Name of the Vulnerable Software and Affected Versions Cleanto version 5.0 Description The issue is related to SQL Injection, which can be exploited via the id parameter in the "assets/lib/export ajax.php" API endpoint. Recommendations For Cleanto version 5.0, avoid using the id parameter in the...
MapSVG Lite <= 3.2.3 - Cross-Site Request Forgery (CSRF)
CSRF in the mapsvgsave AJAX method...
CVE-2018-20368
The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback...
CVE-2018-20368: Improper Neutralization of Input During Web Page Generation
The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback...
PT-2018-15324
Name of the Vulnerable Software and Affected Versions Master Slider plugin versions 3.2.7 and 3.5.1 Description The issue concerns a problem with the Master Slider plugin for WordPress. It is related to XSS via the "Name" input field of the MSPanel.Settings value on Callback, which is accessible...