PT-2018-10406

Name of the Vulnerable Software and Affected Versions Artica Pandora FMS versions prior to 7.23 Description The issue allows an attacker to perform a Local File Inclusion LFI attack. This is achieved by calling any php file via the "/pandora console/ajax.php" API endpoint. Recommendations For...

vapetrotter.com XSS vulnerability

Open Bug Bounty ID: OBB-627043 Description| Value ---|--- Affected Website:| vapetrotter.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

New STAR 2.1 - SQL Injection / Cross-Site Scripting Vulnerabilities

Exploit for php platform in category web applications Exploit Title: New STAR 2.1 - SQL Injection / Cross-Site Scripting Exploit Author: Kağan Çapar Contact: email protected Vendor Homepage: https://codecanyon.net/item/new-star-listen-youtube-music/7486113 Version: 2.1 Category: Webapps Tested on...

New STAR 2.1 Cross Site Scripting / SQL Injection

Exploit Title: New STAR 2.1 - SQL Injection / Cross-Site Scripting Dork: N/A Date: 30.05.2018 Exploit Author: Kagan Capar Contact: [email protected] Vendor Homepage: https://codecanyon.net/item/new-star-listen-youtube-music/7486113 Version: 2.1 Category: Webapps Tested on: Kali Linux Descripti...

New STAR 2.1 - SQL Injection Cross-Site Scripting

New STAR 2.1 - SQL Injection Cross-Site Scripting Exploit Title: New STAR 2.1 - SQL Injection / Cross-Site Scripting Dork: N/A Date: 30.05.2018 Exploit Author: Kağan Çapar Contact: [email protected] Vendor Homepage: https://codecanyon.net/item/new-star-listen-youtube-music/7486113 Version: 2.1...

Sql injection

Blind SQL injection in couponcode in the MemberMouse plugin 2.2.8 and prior for WordPress allows an unauthenticated attacker to dump the WordPress MySQL database via an applyCoupon action in an admin-ajax.php request...

CVE-2018-11309

Blind SQL injection in couponcode in the MemberMouse plugin 2.2.8 and prior for WordPress allows an unauthenticated attacker to dump the WordPress MySQL database via an applyCoupon action in an admin-ajax.php request...

CVE-2018-11309: Improper Neutralization of Special Elements used in an SQL Command

Blind SQL injection in couponcode in the MemberMouse plugin 2.2.8 and prior for WordPress allows an unauthenticated attacker to dump the WordPress MySQL database via an applyCoupon action in an admin-ajax.php request...

PT-2018-10471

Name of the Vulnerable Software and Affected Versions MemberMouse plugin versions 2.2.8 and prior Description The issue concerns a blind SQL injection in the coupon code parameter of the MemberMouse plugin for WordPress. This allows an unauthenticated attacker to extract the WordPress MySQL...

ProfileGrid – User Profiles, Groups and Communities <= 2.8.5 - Authenticated Code Execution

The plugin ProfileGrid – User Profiles, Groups and Communities versions prior to 2.8.6 is vulnerable to Arbitrary Code Execution. An authenticated user with a role as low as Subscriber can execute arbitrary PHP code on websites using the plugin. Send an authenticated POST request to...

PT-2018-9677

Name of the Vulnerable Software and Affected Versions: joyplus-cms version 1.6.0 Description: The issue concerns a Cross-Site Scripting XSS problem. It is exploited through the device name parameter in a "manager/admin ajax.php?action=save flag=add" request, specifically the "/manager/admin...

PT-2018-17938

Name of the Vulnerable Software and Affected Versions osTicket versions prior to 1.10.2 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the message parameter in the "/ajax.php/form/help-topic" API endpoint. Recommendations...

CVE-2018-7192: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in /ajax.php/form/help-topic in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "message" parameter...

CVE-2014-2674

Directory traversal vulnerability in the Ajax Pagination twitter Style plugin 1.1 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the loop parameter in an ajaxnavigation action to wp-admin/admin-ajax.php...

PT-2018-4205

Name of the Vulnerable Software and Affected Versions Ajax Pagination twitter Style plugin version 1.1 for WordPress Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability. This is achieved by using a .. dot dot in the loop parameter in an...

CVE-2014-2674: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Ajax Pagination twitter Style plugin 1.1 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the loop parameter in an ajaxnavigation action to wp-admin/admin-ajax.php...

PT-2018-18622

Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue concerns an XSS vulnerability. It can be exploited via the "manager/admin ajax.php?action=save&tab=prevod type" API endpoint, specifically through the t name parameter. Recommendations For...

PT-2018-18595

Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue allows for CSRF, as demonstrated by adding an administrator account via a "manager/admin ajax.php?action=save&tab=premanager" request. This can be exploited by sending a malicious request to the...

Category Order and Taxonomy Terms Order <= 1.5.2.2 - Authenticated PHP Object Injection

Usage of unserialize on user input in the saving request of the orders leads to PHP object injection vulnerability. PoC Send POST request to "URL/wp-admin/admin-ajax.php" with parameters "action=update-taxonomy-order=SERIALIZED-OBJECT"...

Category Order and Taxonomy Terms Order <= 1.5.2.2 - Authenticated PHP Object Injection

Usage of unserialize on user input in the saving request of the orders leads to PHP object injection vulnerability. Send POST request to "URL/wp-admin/admin-ajax.php" with parameters "action=update-taxonomy-order&order=SERIALIZED-OBJECT"...