CVE-2023-2246: Unrestricted Upload of File with Dangerous Type

A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file admin/ajax.php?action=savesettings. The manipulation of the argument img leads to unrestricted upload. The attack can be initiated...

PT-2023-20826

Name of the Vulnerable Software and Affected Versions Dynamic Transaction Queuing System version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the name parameter at the "/admin/ajax.php?action=login" API endpoint. Recommendations Fo...

CVE-2023-26856: Improper Neutralization of Special Elements used in an SQL Command

Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/ajax.php?action=login...

Authentication flaw

A vulnerability was found in SourceCodester Online Pizza Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file admin/ajax.php?action=saveuser of the component Password Change Handler. The manipulation leads to improper authentication. It is possible to...

CVE-2023-1460: Improper Authentication

A vulnerability was found in SourceCodester Online Pizza Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file admin/ajax.php?action=saveuser of the component Password Change Handler. The manipulation leads to improper authentication. It is possible to...

CVE-2023-0988: Cross-Site Request Forgery (CSRF)

A vulnerability, which was classified as problematic, has been found in SourceCodester Online Pizza Ordering System 1.0. This issue affects some unknown processing of the file admin/ajax.php?action=saveuser. The manipulation leads to cross-site request forgery. The attack may be initiated remotel...

CVE-2022-46953: Improper Neutralization of Special Elements used in an SQL Command

Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=savewindow...

CVE-2022-46955: Improper Neutralization of Special Elements used in an SQL Command

Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=savequeue...

CVE-2022-46952: Improper Neutralization of Special Elements used in an SQL Command

Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=deleteuser...

CVE-2022-46951: Improper Neutralization of Special Elements used in an SQL Command

Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=deleteuploads...

CVE-2022-46950: Improper Neutralization of Special Elements used in an SQL Command

Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=deletewindow...

CVE-2022-46954: Improper Neutralization of Special Elements used in an SQL Command

Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=deletetransaction...

CVE-2022-28590

A Remote Code Execution RCE vulnerability exists in Pixelimity 1.0 via admin/admin-ajax.php?action=installtheme...

PT-2022-2479

Name of the Vulnerable Software and Affected Versions Pixelimity version 1.0 Description A Remote Code Execution RCE issue exists due to the lack of input data sanitization. This allows a remote attacker to execute arbitrary code through the "admin/admin-ajax.php?action=install theme" endpoint. T...

Post Grid < 2.1.16 - Reflected Cross-Site Scripting via post_types

The plugin does not sanitise and escape the posttypes parameter before outputting it back in the response of the postgridupdatetaxonomiestermsbyposttypes AJAX action, available to any authenticated users, leading to a Reflected Cross-Site Scripting " name="posttypes"...

PT-2021-21621

Name of the Vulnerable Software and Affected Versions SEACMS version 210530 Description The issue allows remote attackers to execute arbitrary code via the component "admin ajax.php?action=checkrepeat&v name=". This is a SQL Injection vulnerability. The v name variable in the "admin...

CVE-2021-24200: Improper Neutralization of Special Elements used in an SQL Command

The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajax.php?action=getwdtable&tableid=1, on the 'length' HTTP POST parameter...

PT-2021-11454

Name of the Vulnerable Software and Affected Versions: Simple College Website version 1.0 Description: A SQL injection issue allows remote unauthenticated attackers to bypass the admin authentication mechanism, gaining access to the website administrative panel through the "college...

PT-2021-11455

Name of the Vulnerable Software and Affected Versions: Simple College Website version 1.0 Description: The issue allows a user to conduct remote code execution via the "/alumni/admin/ajax.php?action=save settings" API endpoint when uploading a malicious file using the image upload functionality...

PT-2021-17125

Name of the Vulnerable Software and Affected Versions wpDataTables versions prior to 3.4.1 Description The issue is related to how wpDataTables handles order direction for server-side tables, leading to a SQL injection. This can be exploited through the "admin-ajax.php?action=get wdtable" endpoin...