PT-2020-16188

Name of the Vulnerable Software and Affected Versions SourceCodester Seat Reservation System version 1.0 Description The issue concerns a lack of input validation on the username and password parameters in the admin class.php file. This allows an attacker to send malicious input in the POST reque...

CVE-2020-7916

beteacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role via the wp-admin/admin-ajax.php?action=learnpressbeteacher URI without any additional permission checks. Therefore, any user can change its...

PT-2020-19845

Name of the Vulnerable Software and Affected Versions LearnPress plugin versions 3.2.6.5 and earlier Description The issue allows any registered user to assign itself the teacher role via the "wp-admin/admin-ajax.php?action=learnpress be teacher" API endpoint without any additional permission...

PT-2019-7409

Name of the Vulnerable Software and Affected Versions plugmatter-optin-feature-box-lite plugin versions prior to 2.0.14 Description The issue concerns SQL injection via the "wp-admin/admin-ajax.php?action=pmfb cc" API endpoint, specifically through the pmfb tid parameter. This allows for potentia...

CVE-2015-9438

The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dwshowwidget idbase, widgetnumber, or instance parameter...

CVE-2015-9436

The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=termtree prefix or widgetid parameter...

PT-2019-7380

Name of the Vulnerable Software and Affected Versions olevmedia-shortcodes plugin versions prior to 1.1.9 Description The issue concerns a CSRF with resultant XSS in the olevmedia-shortcodes plugin for WordPress. This occurs via the "wp-admin/admin-ajax.php?action=omsc popup" API endpoint,...

PT-2019-7291

Name of the Vulnerable Software and Affected Versions WordPress uninstall plugin versions prior to 1.2 Description The issue allows for CSRF, enabling the deletion of all tables via the "wp-admin/admin-ajax.php?action=uninstall" API endpoint. Recommendations For versions prior to 1.2, update to...

PT-2019-11257

Name of the Vulnerable Software and Affected Versions: MapSVG Lite versions prior to 3.3.0 Description: The issue allows an attacker to modify post data, including embedding javascript, due to a Cross Site Request Forgery CSRF vulnerability in the REST endpoint...

PT-2018-9677

Name of the Vulnerable Software and Affected Versions: joyplus-cms version 1.6.0 Description: The issue concerns a Cross-Site Scripting XSS problem. It is exploited through the device name parameter in a "manager/admin ajax.php?action=save flag=add" request, specifically the "/manager/admin...