CVE-2019-9787

WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS...

PT-2019-5538

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 5.1.1 Description The issue is related to improper filtering of comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs due to mishandled CSRF protection an...

CVE-2019-9787: Cross-Site Request Forgery (CSRF)

WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS...

CVE-2017-11445

CVE-2017-11445 affects Subrion CMS prior to 4.1.6. The vulnerability is a SQL injection in the file /front/actions.php reachable via the POST data ($_POST), caused by insufficient input handling in Subrion CMS. Reported across multiple sources (CNVD, NVD, OSV, Veracode) with the root cause descri...

CVE-2017-11445

Subrion CMS before 4.1.6 has a SQL injection vulnerability in /front/actions.php via the $POST array...

CVE-2017-11445

Subrion CMS before 4.1.6 has a SQL injection vulnerability in /front/actions.php via the $POST array...

PT-2017-12018

Name of the Vulnerable Software and Affected Versions Subrion CMS versions prior to 4.1.6 Description The issue is related to a SQL injection vulnerability. It affects the /front/actions.php endpoint via the $ POST array. Recommendations For versions prior to 4.1.6, update to version 4.1.6 or lat...

CVE-2017-11445: Improper Neutralization of Special Elements used in an SQL Command

Subrion CMS before 4.1.6 has a SQL injection vulnerability in /front/actions.php via the $POST array...

CVE-2016-6897

Cross-site request forgery CSRF vulnerability in the wpajaxupdateplugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the checkajaxreferer...

CVE-2016-6897

CVE-2016-6897 describes a CSRF vulnerability in WordPress up to version 4.5.x affecting the wp_ajax_update_plugin handler in wp-admin/includes/ajax-actions.php. The issue arises from a late check_ajax_referer call, enabling remote attackers to hijack subscribers’ authentication for /dev/random re...

CVE-2016-10148: Improper Access Control

The wpajaxupdateplugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a getplugindata call before checking the updateplugins capability, which allows remote authenticated users to bypass intended read-access restrictions via the plugin parameter to...

CVE-2016-6896: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the wpajaxupdateplugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remote authenticated users to cause a denial of service or read certain text files via a .. dot dot in the plugin parameter to wp-admin/admin-ajax.php, as...

PT-2017-7770

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.6 Description The issue allows remote authenticated users to bypass intended read-access restrictions. This is related to the wp ajax update plugin function in wp-admin/includes/ajax-actions.php, which makes a get...

foncierdebretagne.fr XSS vulnerability

Vulnerable URL: http://foncierdebretagne.fr/actions.php Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 5797365 VIP website status:| No Coordinated Disclosure Timeline: Description|...

PT-2017-9053

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.6 Description A cross-site request forgery CSRF issue exists, allowing remote attackers to hijack the authentication of subscribers for certain operations by leveraging a late call to the check ajax referer...

CVE-2016-6635

Cross-site request forgery CSRF vulnerability in the wpajaxwpcompressiontest function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option...

CVE-2016-6635

Cross-site request forgery CSRF vulnerability in the wpajaxwpcompressiontest function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option...

CVE-2016-6635: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the wpajaxwpcompressiontest function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option...

PT-2016-7010

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.5 Description A cross-site request forgery CSRF issue exists in the wp ajax wp compression test function, located in wp-admin/includes/ajax-actions.php, allowing remote attackers to hijack administrator...

CVE-2016-5835

WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php...