587 matches found
Contest Gallery < 19.1.5 - Author+ SQL Injection
The plugins do not escape the optionid POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-search.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database. POST...
Directorist < 7.4.4 - Subscriber+ Sensitive Information Disclosure
The plugin does not prevent users with low privileges like subscribers from accessing sensitive system information. fetch'http://wpscan.local/wp-admin/admin-ajax.php', method: 'POST', headers: new Headers 'Content-Type': 'application/x-www-form-urlencoded', , body: 'action=sendsysteminfo',...
WP OAuth Server < 3.4.2 - Client Secret Regeneration via CSRF
The plugin does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret of an arbitrary client given they know the client ID Make a logged in admin open a page containing the HTML code below. This will regenerate the secret for the...
Wordpress ImageMagick-Engine 1.7.4 Plugin - Remote Code Execution (Authenticated) Exploit
Exploit Title: Wordpress Plugin ImageMagick-Engine 1.7.4 - Remote Code Execution RCE Authenticated Google Dork: inurl:"/wp-content/plugins/imagemagick-engine/" Date: Thursday, September 1, 2022 Exploit Author: ABDO10 Vendor Homepage: https://wordpress.org/plugins/imagemagick-engine/ Software Link...
Ocean Extra < 2.0.5 - Admin+ PHP Objection Injection
The plugin unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import intentionally or not a malicious Customizer Styling file and a suitable gadget chain is present on the blog. To simulate a gadget chain, put the following co...
WordPress plugin Scripts Organizer 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An arbitrary file upload...
WP Edit Menu < 1.5.0 - Unauthenticated Arbitrary Post Deletion
The plugin does not have authorisation and CSRF in an AJAX action, which could allow unauthenticated attackers to delete arbitrary posts/pages from the blog https://example.com/wp-admin/admin-ajax.php?action=filtermenu&val=post-id...
CVE-2022-32020
Car Rental Management System v1.0 is vulnerable to Arbitrary code execution via ip/car-rental-management-system/admin/ajax.php?action=savesettings...
Car Rental Management System 代码问题漏洞
Car Rental Management System is a car rental management system. v1.0 of Car Rental Management System contains an arbitrary code execution vulnerability that can be exploited by attackers to execute arbitrary code via ip/Car Rental Management System/admin/ ajax.php to execute arbitrary code attack...
User Meta < 2.4.4 - Subscriber+ Local File Enumeration via Path Traversal
The plugin does not validate the filepath parameter of its umshowuploadedfile AJAX action, which could allow low privileged users such as subscriber to enumerate the local files on the web server via path traversal payloads As a subscriber, submit a dummy image on a page/post with a File Upload...
Files Download Delay < 1.0.7 - Subscriber+ Settings Reset
The plugin does not have authorisation and CSRF checks when reseting its settings, which could allow any authenticated users, such as subscriber to perform such action. https://example.com/wp-admin/admin-ajax.php?action=ddlayrestoredefaults...
The vulnerability of the CMS system Pixelimity lies in the lack of measures to cleanse input data, allowing attackers to execute arbitrary code.
The vulnerability of the CMS system Pixelimity is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through admin/admin-ajax.php?action=installtheme remotely...
CVE-2022-28590
A Remote Code Execution RCE vulnerability exists in Pixelimity 1.0 via admin/admin-ajax.php?action=installtheme...
Pixelimity 安全漏洞
Pixelimity is a PHP-based open source CMS Content Management System. A security vulnerability exists in Pixelimity version 1.0, which stems from a Remote Code Execution RCE vulnerability in admin/admin-ajax.php?action=installtheme...
HongCMS 路径遍历漏洞
HongCMS is an open source lightweight content management system CMS. A security vulnerability exists in HongCMS version 3.0.0, which originates from the deletion of arbitrary files via the component /admin/index.php/template/ajax?action=delete...
WPC Smart Wishlist for WooCommerce < 2.9.9 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX action, leading to a Reflected Cross-Site Scripting issue. Against any authenticated user: ' /...
CVE-2022-28035
Atom.CMS 2.0 is vulnerable to SQL Injection via Atom.CMSadminajaxblur-save.php...
CVE-2022-28035
Atom.CMS 2.0 is vulnerable to SQL Injection via Atom.CMSadminajaxblur-save.php...