CVE-2023-51048

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the Anewsauth parameter at /admin/ajax.php...

CVE-2023-51048

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the Anewsauth parameter at /admin/ajax.php...

CVE-2023-51049

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the Abbsauth parameter at /admin/ajax.php...

S-CMS Security Vulnerabilities

S-CMS is a PHP and MySQL based Content Management System CMS from S-CMS China. A security vulnerability exists in S-CMS v5.0, which originates from the discovery of an SQL injection vulnerability via the Atextauth parameter in /admin/ajax.php...

PT-2023-31749 · S Cms · S-Cms

Name of the Vulnerable Software and Affected Versions: S-CMS version 5.0 Description: The issue is related to a SQL injection vulnerability. It can be exploited via the A bbsauth parameter at the "/admin/ajax.php" API endpoint. Recommendations: For S-CMS version 5.0, consider restricting access t...

PT-2023-31748 · S Cms · S-Cms

Name of the Vulnerable Software and Affected Versions: S-CMS version 5.0 Description: The issue is related to a SQL injection vulnerability. It can be exploited via the A newsauth parameter at the "/admin/ajax.php" API endpoint. Recommendations: For S-CMS version 5.0, consider restricting access ...

PT-2023-31753 · S Cms · S-Cms

Name of the Vulnerable Software and Affected Versions: S-CMS version 5.0 Description: The issue is a SQL injection vulnerability. It can be exploited via the A formauth parameter at the "/admin/ajax.php" API endpoint. Recommendations: For S-CMS version 5.0, consider restricting access to the...

S-CMS Security Vulnerabilities

S-CMS is a PHP and MySQL based Content Management System CMS from S-CMS China. A security vulnerability exists in S-CMS v5.0, which originates from the discovery of an SQL injection vulnerability via the Anewsauth parameter in /admin/ajax.php...

S-CMS Security Vulnerabilities

S-CMS is a PHP and MySQL based Content Management System CMS from S-CMS China. A security vulnerability exists in S-CMS v5.0, which originates from the discovery of an SQL injection vulnerability via the Aproductauth parameter in /admin/ajax.php...

S-CMS Security Vulnerabilities

S-CMS is a PHP and MySQL based Content Management System CMS from S-CMS China. A security vulnerability exists in S-CMS v5.0, which originates from the discovery of an SQL injection vulnerability via the Aformauth parameter in /admin/ajax.php...

Quiz Maker < 6.4.9.5 - Unauthenticated Email Address Disclosure

Description The plugin does not adequately authorize the aysquizauthorusersearch AJAX action, allowing an unauthenticated attacker to perform a search for users of the system, ultimately leaking user email addresses. import string import requests baseurl =...

VulnCheck KEV: CVE-2018-16159

The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the templateid parameter in a wp-admin/admin-ajax.php wpgvdoajaxfronttemplate request...

The vulnerability in the admin-ajax.php script of the Photo Gallery administration panel of the WordPress content management system allows a hacker to execute arbitrary SQL code.

The vulnerability in the admin-ajax.php script of the Photo Gallery administration panel of the WordPress content management system is related to the failure to protect the SQL query structure during the processing of the bwgtagidbwgthumbnails0 parameter. Exploiting this vulnerability allows an...

The vulnerability in the admin-ajax.php plugin’s script for creating pages using the Page Builder tool of the WordPress content management system. This vulnerability allows a hacker to redirect users to an arbitrary URL address.

The vulnerability in the admin-ajax.php plugin’s page creation script, developed by KingComposer, a WordPress content management system, relates to the use of open redirection during the processing of the kcgetthumbn parameter. Exploiting this vulnerability could allow an attacker to redirect use...

EventPrime < 3.2.0 - Booking Creation via CSRF

Description The plugin does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks. Create an Event, noting its ID. Add a ticket type to the Event the details don't matter. As a logged-in user, visit a page with t...

WordPress Page Builder KingComposer 2.9.5 Open Redirection

==================================================================================================================================== | Title : WordPress Page Builder KingComposer 2.9.5 Open Redirect Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla...

CVE-2020-20210

Bludit 3.9.2 is vulnerable to Remote Code Execution RCE via /admin/ajax/upload-images...

Dynamic Transaction Queuing System 代码问题漏洞

Dynamic Transaction Queuing System is a dynamic transaction queuing system using PHP/MySQL by Carlo Montero's personal developer. A security vulnerability exists in the v1.0 version of Dynamic Transaction Queuing System, which stems from an arbitrary file upload issue in...

WP Meta SEO < 4.5.5 - Author+ PHAR Deserialization

The plugin does not validate image file paths before attempting to manipulate the image files, leading to a PHAR deserialization vulnerability. Furthermore, the plugin contains a gadget chain which may be used in certain configurations to achieve remote code execution. 1. Use a WordPress instance...

Woo Bulk Price Update < 2.2.2 - Reflected XSS

The plugin does not sanitize and escape escape the page parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged in admin open...