SOPlanning XSS

The vulnerability of the SOPlanning/www/process/xajaxserver.php component of the SOPlanning CMS system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

CVE-2024-9571

Cross-Site Scripting XSS vulnerability in SOPlanning 1.45, due to lack of proper validation of user input via /soplanning/www/process/xajaxserver.php, affecting multiple parameters. This could allow a remote user to send a specially crafted query to an authenticated user and partially take contro...

SOPlanning Cross-Site Request Forgery Vulnerability (CNVD-2020-10484)

SOPlanning is an online planning tool for efficiently organizing projects and tasks. SOPlanning 1.45 suffers from a cross-site request forgery vulnerability. An attacker can exploit this vulnerability to arbitrarily change the administrator password via process/xajaxserver.php...

SOPlanning Cross-Site Request Forgery Vulnerability

SOPlanning is an online planning tool for efficiently organizing projects and tasks. SOPlanning 1.45 suffers from a cross-site request forgery vulnerability. An attacker can exploit this vulnerability to create arbitrary users via process/xajaxserver.php...

CVE-2020-9267

SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary user creation via process/xajaxserver.php...

PT-2020-20561

Name of the Vulnerable Software and Affected Versions SOPlanning version 1.45 Description The issue allows for a CSRF attack, enabling arbitrary user creation via the "process/xajax server.php" API endpoint. Recommendations For SOPlanning version 1.45, consider restricting access to the...

PT-2020-20560

Name of the Vulnerable Software and Affected Versions SOPlanning version 1.45 Description The issue allows for a CSRF attack, enabling arbitrary changes to the admin password through the "process/xajax server.php" endpoint. Recommendations For SOPlanning version 1.45, consider restricting access ...

OpenNetAdmin 18.1.1 Remote Code Execution

Exploit Title: OpenNetAdmin 18.1.1 - Remote Code Execution Date: 2019-11-19 Exploit Author: mattpascoe Vendor Homepage: http://opennetadmin.com/ Software Link: https://github.com/opennetadmin/ona Version: v18.1.1 Tested on: Linux Exploit Title: OpenNetAdmin v18.1.1 RCE Date: 2019-11-19 Exploit...

CVE-2010-4951

The CVE-2010-4951 issue affects the TYPO3 ecosystem via the xaJax Shoutbox (vx_xajax_shoutbox) extension prior to 1.0.1. According to the provided sources, this is a Cross-site Scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML through unspecified ve...

PT-2011-1886

Name of the Vulnerable Software and Affected Versions TYPO3 extension vx xajax shoutbox version 1.0.0 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. Recommendations For version 1.0.0, update to version 1.0.1 or later to resol...

CVE-2010-4951: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the xaJax Shoutbox vxxajaxshoutbox extension before 1.0.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-3821

xajax 0.6 beta1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by xajaxcore/pluginlayer/xajaxScriptPlugin.inc.php and certain other files...

CVE-2011-3821

xajax 0.6 beta1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by xajaxcore/pluginlayer/xajaxScriptPlugin.inc.php and certain other files...

Information disclosure

xajax 0.6 beta1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by xajaxcore/pluginlayer/xajaxScriptPlugin.inc.php and certain other files...

UBUNTU-CVE-2011-3821

xajax 0.6 beta1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by xajaxcore/pluginlayer/xajaxScriptPlugin.inc.php and certain other files...

PT-2011-4711

Name of the Vulnerable Software and Affected Versions xajax version 0.6 beta1 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is achieved by exploiting the error message that reveals the installation path. Specifically, files...

CVE-2011-3821

xajax 0.6 beta1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by xajaxcore/pluginlayer/xajaxScriptPlugin.inc.php and certain other files...

CVE-2011-3821

CVE-2011-3821 affects xajax 0.6 beta1. A direct request to a vulnerable PHP file (e.g., xajax_core/plugin_layer/xajaxScriptPlugin.inc.php and related files) may disclose the installation path via an error message. The provided documents confirm the information-disclosure impact but do not describ...

CVE-2011-3821: Exposure of Sensitive Information to an Unauthorized Actor

xajax 0.6 beta1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by xajaxcore/pluginlayer/xajaxScriptPlugin.inc.php and certain other files...

xAjax Cross Site Scripting / Path Disclosure

Hello list! I want to warn you about Cross-Site Scripting and Full path disclosure vulnerabilities in xAjax and xajaxjqueryplugin. ------------------------- Affected products: ------------------------- Vulnerable are potentially all versions of xAjax. Vulnerable are all versions of...