Sql injection

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the Aformauth parameter at /admin/ajax.php...

Sql injection

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the Aproductauth parameter at /admin/ajax.php...

Sql injection

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the Anewsauth parameter at /admin/ajax.php...

Sql injection

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the Abbsauth parameter at /admin/ajax.php...

CVE-2023-51048

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the Anewsauth parameter at /admin/ajax.php...

CVE-2023-51052: Improper Neutralization of Special Elements used in an SQL Command

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the Aformauth parameter at /admin/ajax.php...

CVE-2023-51049

CVE-2023-51049 : S-CMS v5.0 has a SQL injection vulnerability via the A_bbsauth parameter in /admin/ajax.php. This is a high-severity issue (CVSS v3.1: 9.8, CRITICAL) with network access, no authentication, no user interaction, and impacts to confidentiality, integrity, and availability. Root cau...

CVE-2023-51050

Summary: CVE-2023-51050 affects S-CMS v5.0, with a SQL injection via the A_productauth parameter in /admin/ajax.php. The Red Hat, NVD, CVE listings, and PT Security entries corroborate the issue and its association with S-CMS 5.0. The PT-2023-31751 advisory notes there is no available fix/version...

CVE-2023-51051

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the Atextauth parameter at /admin/ajax.php...

CVE-2023-51051: Improper Neutralization of Special Elements used in an SQL Command

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the Atextauth parameter at /admin/ajax.php...

CVE-2023-51052

CVE-2023-51052 affects S-CMS v5.0, with a SQL injection vulnerability in the A_formauth parameter of /admin/ajax.php. Root cause: unsafely handling user input in A_formauth allows constructing malicious SQL. Impact per CVSS 3.1: Confidentiality/Integrity/Availability: High; Base score 9.8 (CRITIC...

CVE-2023-51050: Improper Neutralization of Special Elements used in an SQL Command

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the Aproductauth parameter at /admin/ajax.php...

CVE-2023-51051

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the Atextauth parameter at /admin/ajax.php...

CVE-2023-51049

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the Abbsauth parameter at /admin/ajax.php...

CVE-2023-51049: Improper Neutralization of Special Elements used in an SQL Command

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the Abbsauth parameter at /admin/ajax.php...

CVE-2023-51048

CVE-2023-51048 affects S-CMS v5.0 with a SQL injection via the A_newsauth parameter in /admin/ajax.php. Root cause: unsanitized input leading to SQL injection. Impact per sources: high confidentiality, integrity, and availability; attack vector is network with no authentication and no user intera...

CVE-2023-51048: Improper Neutralization of Special Elements used in an SQL Command

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the Anewsauth parameter at /admin/ajax.php...

CVE-2023-51052

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the Aformauth parameter at /admin/ajax.php...

WP Custom Widget Area <= 1.2.5 - Subscriber+ Menus Creation/Deletion/Update

Description The plugin does not properly apply capability and nonce checks on any of its AJAX action callback functions, which could allow attackers with subscriber+ privilege to create, delete or modify menus on the site. Log in as a subscriber, and paste any of the following fetch call in your...

PT-2023-31256

Name of the Vulnerable Software and Affected Versions Customer Support System version v1 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the username parameter at the "/customer support/ajax.php?action=login" API endpoint. Recommendations...