CVE-2015-0211: Exposure of Sensitive Information to an Unauthorized Actor

mod/lti/ajax.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 does not consider the moodle/course:manageactivities and mod/lti:addinstance capabilities before proceeding with registered-tool list searches, which allows remote authenticated users to obtai...

Cross site scripting

Cross-site scripting XSS vulnerability in the Free Counter plugin 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value parameter in a checkstat action to wp-admin/admin-ajax.php...

CVE-2015-4084

Cross-site scripting XSS vulnerability in the Free Counter plugin 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value parameter in a checkstat action to wp-admin/admin-ajax.php...

CVE-2015-4084: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Free Counter plugin 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value parameter in a checkstat action to wp-admin/admin-ajax.php...

PT-2015-6412

Name of the Vulnerable Software and Affected Versions Free Counter plugin version 1.1 for WordPress Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the value parameter in a check stat action to "wp-admin/admin-ajax.php" API endpoint...

Wordpress Theme Nevada Arbitrary File Download Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Theme Nevada Arbitrary File Download Vulnerability Date: 01/05/2015 Exploit Author: X-Line Vendor Homepage: http://themeforest.unitedthemes.com/wpversions/nevada/ Contact : http://www.root-me.org/X-Line-24646 Tested on...

WordPress DZS Video Gallery Plugin - Reflected XSS

This plugin is prone to a cross site scripting vulnerability in ajax.php source parameter. Solution Update the plugin...

WordPress Rockhoist Ratings Plugin <= 1.2.2 - SQL Injection

This plugin is prone to an SQL injection vulnerability in wp-admin/admin-ajax.php postID parameter. Solution Update the plugin...

WordPress Better WP Security Plugin <= 3.6.3 - Stored XSS

This plugin is prone to /wp-admin/admin-ajax.php license parameter stored XSS weakness. Solution Upgrade the plugin...

CVE-2012-5849

Multiple SQL injection vulnerabilities in ClipBucket 2.6 Revision 738 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 uid parameter in an addfriend action to ajax.php; id parameter in a 2 shareobject, 3 addtofav, 4 rating, or 5 flagobject action to ajax.php; cid...

PT-2015-3532

Name of the Vulnerable Software and Affected Versions ClipBucket versions 2.6 Revision 738 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via various parameters in different actions to "ajax.php", including the uid parameter in an...

CVE-2012-5849: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in ClipBucket 2.6 Revision 738 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 uid parameter in an addfriend action to ajax.php; id parameter in a 2 shareobject, 3 addtofav, 4 rating, or 5 flagobject action to ajax.php; cid...

WeBid 1.1.1 /ajax.php 文件上传漏洞

No description provided by source...

CVE-2014-9311

Cross-site scripting XSS vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the locationid parameter in a shareaholicaddlocation action to wp-admin/admin-ajax.php...

Cross site scripting

Cross-site scripting XSS vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the locationid parameter in a shareaholicaddlocation action to wp-admin/admin-ajax.php...

CVE-2014-9311

Cross-site scripting XSS vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the locationid parameter in a shareaholicaddlocation action to wp-admin/admin-ajax.php...

CVE-2014-9311

Cross-site scripting XSS vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the locationid parameter in a shareaholicaddlocation action to wp-admin/admin-ajax.php...

WordPress Plugin Video Gallery 2.8 - SQL Injection

WordPress Plugin Video Gallery 2.8 - SQL Injection Exploit Title : Wordpress Video Gallery 2.8 SQL Injection Vulnerabilitiey Exploit Author : Claudio Viviani Vendor Homepage : http://www.apptha.com/category/extension/Wordpress/Video-Gallery Software Link :...

PT-2015-4182

Name of the Vulnerable Software and Affected Versions Shareaholic plugin versions prior to 7.6.1.0 for WordPress Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote authenticated users to inject arbitrary web script or HTML via the locationid parameter i...

CVE-2014-9311: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the locationid parameter in a shareaholicaddlocation action to wp-admin/admin-ajax.php...