2326 matches found
Cross site scripting
The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php...
CVE-2018-14846
The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php...
PT-2018-12759
Name of the Vulnerable Software and Affected Versions Mondula Multi Step Form plugin versions prior to 1.2.8 Description The issue concerns multiple stored XSS instances. The vulnerability can be exploited via the "wp-admin/admin-ajax.php" API endpoint. Recommendations For versions prior to 1.2.8...
CVE-2018-14846: Improper Neutralization of Input During Web Page Generation
The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php...
advancedcustomfields.com XSS vulnerability
Open Bug Bounty ID: OBB-707391 Description| Value ---|--- Affected Website:| advancedcustomfields.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
wp-jobhunt-exploit
wp-jobhunt-exploit CVE-2018-19487, CVE-2018-19488, exploit for...
Cross site request forgery (csrf)
An issue was discovered in S-CMS v1.5. There is a CSRF vulnerability that can add a new user via the admin/ajax.php?type=member&action=add URI...
CVE-2018-19332
An issue was discovered in S-CMS v1.5. There is a CSRF vulnerability that can add a new user via the admin/ajax.php?type=member&action=add URI...
PT-2018-14921
Name of the Vulnerable Software and Affected Versions S-CMS version 1.5 Description A CSRF issue allows adding a new user via the "admin/ajax.php?type=member&action=add" API endpoint. Recommendations For S-CMS version 1.5, consider implementing proper CSRF protection mechanisms to prevent...
CVE-2018-19332: Cross-Site Request Forgery (CSRF)
An issue was discovered in S-CMS v1.5. There is a CSRF vulnerability that can add a new user via the admin/ajax.php?type=member&action=add URI...
Surreal ToDo 0.6.1.2 - SQL Injection
Surreal ToDo 0.6.1.2 - SQL Injection Exploit Title: Surreal ToDo 0.6.1.2 - SQL Injection Dork: N/A Date: 2018-11-08 Exploit Author: Ihsan Sencan Vendor Homepage: http://getsurreal.com/surrealtodo Software Link:...
WordPress WP GDPR Compliance Plugin Privilege Escalation
The Wordpress GDPR Compliance plugin use auxiliary/admin/http/wp/gdprcomplianceprivesc msf undefinedgdprcomplianceprivesc show actions ...actions... msf undefinedgdprcomplianceprivesc set ACTION msf undefinedgdprcomplianceprivesc show options ...show and set options... msf...
CVE-2018-18717
An issue was discovered in Eleanor CMS through 2015-03-19. XSS exists via the ajax.php?direct=admin&file=autocomplete&query=XSS URI...
Cross site scripting
An issue was discovered in Eleanor CMS through 2015-03-19. XSS exists via the ajax.php?direct=admin&file=autocomplete&query=XSS URI...
CVE-2018-18717
CVE-2018-18717 affects Eleanor CMS up to 2015-03-19. It is an XSS vulnerability exploitable through the AJAX endpoint ajax.php?direct=admin&file=autocomplete&query=[XSS] where the attacker-controlled query is reflected in the response. NVD lists CVSSv2 base 3.5 (LOW) and CVSSv3 base 4.8 (MEDIUM)....
CVE-2018-18717: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Eleanor CMS through 2015-03-19. XSS exists via the ajax.php?direct=admin&file=autocomplete&query=XSS URI...
PT-2018-14595
Name of the Vulnerable Software and Affected Versions Eleanor CMS versions prior to 2015-03-19 Description A security issue exists in the software, where XSS is possible via the "ajax.php?direct=admin&file=autocomplete&query=XSS" URI. This allows for potential exploitation. Recommendations For...
Flow-Flow Social Stream <= 3.0.71 - Unauthenticated Cross-Site Scripting (XSS)
Cross-Site Scripting XSS vulnerability in the JSON output by modifying the hash parameter in admin-ajax.php using the fetchposts action. Response Content-Type set to html. PoC http://www.example.com/wp-admin/admin-ajax.php?action=fetchposts&stream-id;=1=%3Cimg%20src=x%20onerror=alert1%3E...
ClipBucket 2.8 - id SQL Injection
ClipBucket 2.8 - id SQL Injection Exploit Title: ClipBucket 2.8 - 'id' SQL Injection Dork: N/A Date: 2018-10-25 Exploit Author: Ihsan Sencan Vendor Homepage: http://clipbucket.com/ Software Link: https://sourceforge.net/projects/clipbucket/files/latest/download Version: 2.8.v3354 Category: Webapp...
ClipBucket 2.8 - 'id' SQL Injection
Exploit Title: ClipBucket 2.8 - 'id' SQL Injection Dork: N/A Date: 2018-10-25 Exploit Author: Ihsan Sencan Vendor Homepage: http://clipbucket.com/ Software Link: https://sourceforge.net/projects/clipbucket/files/latest/download Version: 2.8.v3354 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64...