PT-2022-20697

Name of the Vulnerable Software and Affected Versions Simple Inventory System version 1.0 Description The issue allows for SQL Injection via the "/inventory/table edit ajax.php" API endpoint. Recommendations For Simple Inventory System version 1.0, consider disabling access to the "/inventory/tab...

Visualizer < 3.7.7 - Reflected Cross-Site Scripting

The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting https://example.com/wp-admin/admin-ajax.php?action=visualizer-edit-chart&library=yes&chart=6190&tab=visualizer&a"alert/XSS/...

Moodle allows attackers to obtain sensitive information

mod/lti/ajax.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 does not consider the moodle/course:manageactivities and mod/lti:addinstance capabilities before proceeding with registered-tool list searches, which allows remote authenticated users to obtai...

GHSA-FRHC-9HWC-X7J3 Moodle allows attackers to obtain sensitive information

mod/lti/ajax.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 does not consider the moodle/course:manageactivities and mod/lti:addinstance capabilities before proceeding with registered-tool list searches, which allows remote authenticated users to obtai...

Exploit for CVE-2022-28590

CVE-2022-28590 The original discovery and manual PoC is from...

CVE-2022-28590

A Remote Code Execution RCE vulnerability exists in Pixelimity 1.0 via admin/admin-ajax.php?action=installtheme...

Remote code execution

A Remote Code Execution RCE vulnerability exists in Pixelimity 1.0 via admin/admin-ajax.php?action=installtheme...

CVE-2022-28590

CVE-2022-28590 affects Pixelimity 1.0. The vulnerability enables remote code execution via admin/admin-ajax.php?action=install_theme. Multiple sources describe an arbitrary file upload path that can lead to code execution, with public PoC showing webshell upload to facilitate further access. The ...

CVE-2022-28590

A Remote Code Execution RCE vulnerability exists in Pixelimity 1.0 via admin/admin-ajax.php?action=installtheme...

CVE-2022-28590

A Remote Code Execution RCE vulnerability exists in Pixelimity 1.0 via admin/admin-ajax.php?action=installtheme...

PT-2022-2479

Name of the Vulnerable Software and Affected Versions Pixelimity version 1.0 Description A Remote Code Execution RCE issue exists due to the lack of input data sanitization. This allows a remote attacker to execute arbitrary code through the "admin/admin-ajax.php?action=install theme" endpoint. T...

CVE-2022-28590: Undefined Security Weakness

A Remote Code Execution RCE vulnerability exists in Pixelimity 1.0 via admin/admin-ajax.php?action=installtheme...

PT-2022-13435

Name of the Vulnerable Software and Affected Versions Donations WordPress plugin versions prior to 1.8 Description The issue arises from the lack of sanitization and escaping of the nd donations id parameter in SQL statements. This occurs via the /wp-admin/admin-ajax.php AJAX action, specifically...

Contao core SQL Injection Vulnerability

Contao core prior to 2.11.4 has a SQL injection vulnerability in contao-2.11.3\system\modules\backend\Ajax.php...

GHSA-9JQ2-JVWC-P52F Contao core SQL Injection Vulnerability

Contao core prior to 2.11.4 has a SQL injection vulnerability in contao-2.11.3\system\modules\backend\Ajax.php...

zbzcms SQL Injection Vulnerability (CNVD-2022-30430)

zbzcms Station Helper CMS is a content management website of China Station Helper CMS zbzcms Inc. zbzcms version 1.0 has a SQL injection vulnerability, which originates from a SQL injection vulnerability found through the id parameter of /php/ajax.php. No detailed vulnerability details are...

CVE-2022-27129

An arbitrary file upload vulnerability at /admin/ajax.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-27125

zbzcms v1.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the neirong parameter at /php/ajax.php...

Design/Logic Flaw

An arbitrary file upload vulnerability at /admin/ajax.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-27125

CVE-2022-27125 affects zbzcms v1.0, with a stored cross-site scripting (XSS) vulnerability exploitable via the neirong parameter in /php/ajax.php. The NVD entry lists potential impact as partial integrity and low confidentiality, with CVSSv3.1 base score 6.1 (NETWORK, LOW ATTACK COMPLEXITY, USER ...