2319 matches found
PT-2017-14283
Name of the Vulnerable Software and Affected Versions ultimate-form-builder-lite plugin versions prior to 1.3.7 Description The issue concerns SQL Injection, which can lead to PHP Object Injection. This occurs via the API endpoint "/wp-admin/admin-ajax.php". Recommendations For versions prior to...
CVE-2017-15919: Improper Neutralization of Special Elements used in an SQL Command
The ultimate-form-builder-lite plugin before 1.3.7 for WordPress has SQL Injection, with resultant PHP Object Injection, via wp-admin/admin-ajax.php...
Design/Logic Flaw
The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assetsurl parameter in assets/dialog.php, exploitable via wp-admin/admin-ajax.php...
PT-2017-14241
Name of the Vulnerable Software and Affected Versions Pootle Button plugin versions prior to 1.2.0 Description The issue allows for XSS exploitation via the assets url parameter in "assets/dialog.php", which can be accessed through the "/wp-admin/admin-ajax.php" API endpoint. Recommendations For...
CVE-2017-15811: Improper Neutralization of Input During Web Page Generation
The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assetsurl parameter in assets/dialog.php, exploitable via wp-admin/admin-ajax.php...
WordPress Polls 1.2.4 SQL Injection
Exploit Title :WordPress Polls plugin1.2.4 SQL Injection vulnerability Author : Manish Kishan Tanwar AKA error1046 https://twitter.com/IndiShell1046 Date : 22/10/2017 Vulnerable version: 1.2.4 Download Link : https://downloads.wordpress.org/plugin/polls-widget.1.2.4.zip Love to : zero cool,Team...
CVE-2015-7806
The CVE-2015-7806 issue affects the WordPress Form Manager plugin (prior to 1.7.3). The vulnerability is in the fm_saveHelperGatherItems function of ajax.php, enabling remote code execution via unspecified vectors. Multiple sources confirm RCE potential, including CNVD and WPVulndB entries noting...
CVE-2015-7806
Eval injection vulnerability in the fmsaveHelperGatherItems function in ajax.php in the Form Manager plugin before 1.7.3 for WordPress allows remote attackers to execute arbitrary code via unspecified vectors...
CVE-2015-7806
Eval injection vulnerability in the fmsaveHelperGatherItems function in ajax.php in the Form Manager plugin before 1.7.3 for WordPress allows remote attackers to execute arbitrary code via unspecified vectors...
CVE-2015-7806: Improper Neutralization of Special Elements used in a Command
Eval injection vulnerability in the fmsaveHelperGatherItems function in ajax.php in the Form Manager plugin before 1.7.3 for WordPress allows remote attackers to execute arbitrary code via unspecified vectors...
PT-2017-7275
Name of the Vulnerable Software and Affected Versions Form Manager plugin versions prior to 1.7.3 Description The issue concerns an eval injection vulnerability in the fm saveHelperGatherItems function within the ajax.php file of the Form Manager plugin for WordPress. This allows remote attackers...
Cross site scripting
Cross-site scripting XSS vulnerability in the Easy Contact Form Solution plugin before 1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value parameter in a masterresponse action to wp-admin/admin-ajax.php...
CVE-2014-7240
Cross-site scripting XSS vulnerability in the Easy Contact Form Solution plugin before 1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value parameter in a masterresponse action to wp-admin/admin-ajax.php...
PT-2017-6001
Name of the Vulnerable Software and Affected Versions: Easy Contact Form Solution plugin versions prior to 1.7 Description: The issue allows remote attackers to inject arbitrary web script or HTML. This is achieved by exploiting the value parameter in a master response action to the...
CVE-2014-7240: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Easy Contact Form Solution plugin before 1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value parameter in a masterresponse action to wp-admin/admin-ajax.php...
CVE-2017-14597
AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XSS via the txtDomainName field to adminpanel/modules/pro/inc/ajax.php during addition of a domain...
PT-2017-13570
Name of the Vulnerable Software and Affected Versions AfterLogic WebMail version 7.7 AfterLogic Aurora version 7.7.5 Description The issue concerns an XSS vulnerability in the AdminPanel of AfterLogic WebMail and Aurora. This vulnerability can be exploited via the txtDomainName field in the...
CVE-2017-14597: Improper Neutralization of Input During Web Page Generation
AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XSS via the txtDomainName field to adminpanel/modules/pro/inc/ajax.php during addition of a domain...
Sql injection
SQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the watuproquestions parameter in a watuprosubmit action to wp-admin/admin-ajax.php...
CVE-2017-9834: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the watuproquestions parameter in a watuprosubmit action to wp-admin/admin-ajax.php...