CVE-2018-18373

In the Schiocco "Support Board - Chat And Help Desk" plugin 1.2.3 for WordPress, a Stored XSS vulnerability has been discovered in file upload areas in the Chat and Help Desk sections via the msg parameter in a /wp-admin/admin-ajax.php sbajaxaddmessage action...

CVE-2018-18373

CVE-2018-18373 concerns the Schiocco “Support Board – Chat And Help Desk” WordPress plugin (version 1.2.3). The stored XSS occurs in file upload areas within the Chat and Help Desk sections via the msg parameter in the /wp-admin/admin-ajax.php sb_ajax_add_message action. Multiple connected source...

PT-2018-14420

Name of the Vulnerable Software and Affected Versions Schiocco Support Board - Chat And Help Desk plugin version 1.2.3 Description A Stored XSS issue has been found in the file upload areas of the Chat and Help Desk sections. This is achieved via the msg parameter in the "/wp-admin/admin-ajax.php...

WordPress Plugin Support Board 1.2.3 - Cross-Site Scripting

WordPress Plugin Support Board 1.2.3 - Cross-Site Scripting Exploit Title: Wordpress Plugin Support Board 1.2.3 - Cross-Site Scripting Date: 2018-10-16 Exploit Author: Ismail Tasdelen Vendor Homepage: https://schiocco.com/ Software Link : https://board.support/ Software : Support Board - Chat And...

Sql injection

An issue was discovered in DuomiCMS 3.0. SQL injection exists in the ajax.php file, as demonstrated by the uid parameter...

CVE-2018-18084

An issue was discovered in DuomiCMS 3.0. SQL injection exists in the ajax.php file, as demonstrated by the uid parameter...

CVE-2018-18084

An issue was discovered in DuomiCMS 3.0. SQL injection exists in the ajax.php file, as demonstrated by the uid parameter...

CVE-2018-18084

An SQL injection vulnerability exists in DuomiCMS 3.0 within the ajax.php file. The flaw is triggered via the uid parameter, which allows for improper neutralization of special elements used in an SQL command. This vulnerability has been observed in the wild and identified in honeypot environment...

PT-2018-14339

Name of the Vulnerable Software and Affected Versions DuomiCMS version 3.0 Description An issue exists in the software, specifically a SQL injection in the ajax.php file. This is demonstrated by the uid parameter. Recommendations For DuomiCMS version 3.0, consider restricting access to the ajax.p...

CVE-2018-18084: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in DuomiCMS 3.0. SQL injection exists in the ajax.php file, as demonstrated by the uid parameter...

PT-2018-13748

Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7 SP2 Description The issue allows for XSS via an onhashchange attribute in the msg parameter to "/plus/feedback ajax.php" API endpoint. Recommendations For DedeCMS version 5.7 SP2, consider restricting access to the...

Design/Logic Flaw

The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userproshortcodetemplate action to wp-admin/admin-ajax.php...

CVE-2018-16285

The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userproshortcodetemplate action to wp-admin/admin-ajax.php...

CVE-2018-16285: Improper Neutralization of Input During Web Page Generation

The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userproshortcodetemplate action to wp-admin/admin-ajax.php...

PT-2018-13463

Name of the Vulnerable Software and Affected Versions UserPro plugin versions prior to 4.9.24 Description The issue allows for XSS via the shortcode parameter in a userpro shortcode template action to the "/wp-admin/admin-ajax.php" API endpoint. Recommendations For versions prior to 4.9.24, updat...

CVE-2018-16159

The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the templateid parameter in a wp-admin/admin-ajax.php wpgvdoajaxfronttemplate request...

PT-2018-13432

Name of the Vulnerable Software and Affected Versions The Gift Vouchers plugin versions prior to 2.0.2 Description The issue allows SQL Injection via the template id parameter in a "wp-admin/admin-ajax.php" wpgv doajax front template request. This could potentially lead to unauthorized access to...

CVE-2018-16159: Improper Neutralization of Special Elements used in an SQL Command

The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the templateid parameter in a wp-admin/admin-ajax.php wpgvdoajaxfronttemplate request...

themesdad.com XSS vulnerability

Open Bug Bounty ID: OBB-669086 Description| Value ---|--- Affected Website:| themesdad.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

downloadnulled.pw XSS vulnerability

Open Bug Bounty ID: OBB-669047 Description| Value ---|--- Affected Website:| downloadnulled.pw Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...