CVE-2019-16660

joyplus-cms 1.6.0 has adminajax.php?action=savexml&tab=vodplay CSRF...

UBUNTU-CVE-2016-10148

The wpajaxupdateplugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a getplugindata call before checking the updateplugins capability, which allows remote authenticated users to bypass intended read-access restrictions via the plugin parameter to...