15004 matches found
CVE-2023-2526
The Easy Google Maps plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.11.7. This is due to missing or incorrect nonce validation on the AJAX action handler. This makes it possible for unauthenticated attackers to executes AJAX actions via a forg...
MAL-2025-4334 Malicious code in document-list-extra-questions (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 17f311a1014dd39c97963383ae0240c9ced38e74b96e8b880acd9c1bf8974c56 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-4391 Malicious code in rapper-wish (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab0c771060f1519932c1a3aa17e1bb894fe76c1fc825c39a1abe9f76b77d5874 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-4399 Malicious code in seamless-sppmy (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0389a6eb1c890ee2de52f64fe14cf1cea2bf0a952bfabdde2686784ddaece9ea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-4338 Malicious code in env-platform (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 75c55ff102f0d25988d4591334d7aeafa4f43877f5d7f248e861ae77a9dabfea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-4342 Malicious code in estatement-fe (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f2d1698e2eb52857509dec5140bc7c61a137d2005a1c097bdb0cbab9d5c1e77a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-4376 Malicious code in mshop2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b230b23967aac14c732f470e9bfd9d34d27bf592c1e3ca7150e827ef17cf5e91 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2022-43972
A null pointer dereference vulnerability exists in Linksys WRT54GL Wireless-G Broadband Router with firmware = 4.30.18.006. A null pointer dereference in the soapaction function within the upnp binary can be triggered by an unauthenticated attacker via a malicious POST request invoking the...
CVE-2022-3254
The WordPress Classifieds Plugin WordPress plugin before 4.3 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users and when a specific premium module is active, leading to a SQL injection...
CVE-2022-29220
github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests PRs. Prior to version 3.2.0, github-action-merge-dependabot does not check if a commit created by dependabot is verified with the proper GPG key. There is just a check if the actor is set t...
CVE-2022-32019
Car Rental Management System v1.0 is vulnerable to Arbitrary code execution via car-rental-management-system/admin/ajax.php?action=savecar...
CVE-2022-1793
The Private Files WordPress plugin through 0.40 is missing CSRF check when disabling the protection, which could allow attackers to make a logged in admin perform such action via a CSRF attack and make the blog public...
CVE-2022-2405
The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subscribers to delete arbitrary Popup...
CVE-2022-46952
Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=deleteuser...
CVE-2022-2461
The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tptranslation' AJAX action and default settings which makes it possib...
CVE-2022-32391
Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/actions/viewaction.php:4...
CVE-2022-4701
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpractivaterequiredplugins' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to activate the...
CVE-2022-4101
The Images Optimize and Upload CF7 WordPress plugin through 2.1.4 does not validate the file to be deleted via an AJAX action available to unauthenticated users, which could allow them to delete arbitrary files on the server via path traversal attack...
CVE-2022-4711
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wprsavemegamenusettings' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to enable and modify Mega Menu...