OSMapper <= 2.1.5 - Unauthenticated Arbitrary Post Deletion

The plugin contains an AJAX action to delete a plugin related post type named 'map' and is registered with the wpajaxnopriv prefix, making it available to unauthenticated users. There is no authorisation, CSRF and checks in place to ensure that the post to delete is a map one. As a result,...

CVE-2022-25412

Maxsite CMS v180 was discovered to contain multiple arbitrary file deletion vulnerabilities in /adminpage/all-files-update-ajax.php via the dir and deletefile parameters...

Cross site request forgery (csrf)

The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php file, which could allow attackers to make logged in users do unwanted actions. For example, make an admin delete arbitrary files...

PT-2022-17276

Name of the Vulnerable Software and Affected Versions Maxsite CMS version v180 Description The issue allows for arbitrary file deletion. This is achieved through the /admin page/all-files-update-ajax.php endpoint via the dir and deletefile parameters. Recommendations For Maxsite CMS version v180,...

CVE-2021-24823: Cross-Site Request Forgery (CSRF)

The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php file, which could allow attackers to make logged in users do unwanted actions. For example, make an admin delete arbitrary files...

Infographic Maker - iList < 4.3.8 - Unauthenticated SQL Injection

The plugin does not validate and escape the postid parameter before using it in a SQL statement via the qcldupvoteaction AJAX action available to unauthenticated and authenticated users, leading to an unauthenticated SQL Injection curl https://example.com/wp-admin/admin-ajax.php --data...

CVE-2022-25412: Improper Limitation of a Pathname to a Restricted Directory

Maxsite CMS v180 was discovered to contain multiple arbitrary file deletion vulnerabilities in /adminpage/all-files-update-ajax.php via the dir and deletefile parameters...

Formcraft3 < 3.8.28 - Unauthenticated SSRF

The plugin does not validate the URL parameter in the formcraft3get AJAX action, leading to SSRF issues exploitable by unauthenticated users https://example.com/wp-admin/admin-ajax.php?action=formcraft3get&URL=https://wpscan.com...

PT-2022-9473

Name of the Vulnerable Software and Affected Versions The Support Board WordPress plugin versions prior to 3.3.6 Description The issue concerns the lack of CSRF checks in actions handled by the include/ajax.php file. This could allow attackers to make logged-in users perform unwanted actions, suc...

PT-2022-13053

Name of the Vulnerable Software and Affected Versions WOOCS WordPress plugin versions prior to 1.3.7.5 Description The issue concerns a Reflected Cross-Site Scripting problem. It arises because the woocs in order currency parameter of the /wp-admin/admin-ajax.php AJAX action woocs get products...

WordPress MasterStudy LMS 2.7.5 Plugin - Unauthenticated Admin Account Creation Vulnerability

Title: WordPress Plugin MasterStudy LMS 2.7.5 - Unauthenticated Admin Account Creation Author: Numan Türle CVE: CVE-2022-0441 Software Link: https://wordpress.org/plugins/masterstudy-lms-learning-management-system/ Version: 2.7.6 https://www.youtube.com/watch?v=SIO6CHXMZk...

hub2word <= 1.1.0 - Subscriber+ Arbitrary Options Update

The plugin does not have authorisation and CSRF checks in its Hub2Wordsavesettings AJAX action, and does not validate the option key to be updated. As a result, any authenticated user, such as subscriber could update arbitrary WordPress options POST /wp-admin/admin-ajax.php HTTP/1.1 Accept:...

PT-2022-7047

Name of the Vulnerable Software and Affected Versions The Photo Gallery by 10Web WordPress plugin versions prior to 1.6.0 Description The issue is related to a lack of validation and escaping of the bwg tag id bwg thumbnails 0 parameter in SQL statements via the /wp-admin/admin-ajax.php endpoint,...

WordPress GDPR & CCPA < 1.9.27 - Unauthenticated Reflected Cross-Site Scripting

The checkprivacysettings AJAX action of the plugin, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript...

Sourcecodester Simple Music Clour Community System SQL Injection Vulnerability

Sourcecodester Simple Music Clour Community System is a simple music cloud community system. sourcecodester Simple Music Clour Community System has a SQL injection vulnerability in version v1.0, which originates from the product / music/ajax.php page fails to properly filter the email parameter f...

Sql injection

An SQL Injection vulnerability exists in Sourceodester Courier Management System 1.0 via the email parameter in /cms/ajax.php app...

CVE-2021-46198: Improper Neutralization of Special Elements used in an SQL Command

An SQL Injection vulnerability exists in Sourceodester Courier Management System 1.0 via the email parameter in /cms/ajax.php app...

PT-2022-12605

Name of the Vulnerable Software and Affected Versions Sourceodester Courier Management System version 1.0 Description An SQL Injection issue exists via the email parameter in the "/cms/ajax.php" API endpoint. This allows for potential exploitation. Recommendations For Sourceodester Courier...

CVE-2021-46200: Improper Neutralization of Special Elements used in an SQL Command

An SQL Injection vulnerability exists in Sourcecodester Simple Music Clour Community System 1.0 via the email parameter in /music/ajax.php...

Give < 2.17.3 - Unauthenticated Reflected Cross-Site Scripting

The plugin does not sanitise and escape the formid parameter before outputting it back in the response of an unauthenticated request via the givecheckoutlogin AJAX action, leading to a Reflected Cross-Site Scripting As an unauthenticated user: alert/XSS/' / var form1 =...