CVE-2019-20059

CVE-2019-20059 Yetishare में sSortDir0 पैरामीटर में SQL इंजेक्शन - v3.5.2 - v4.5.4। एक व्यवस्थापक द्वारा इसका शोषण किए जाने के अलावा, इसका उपयोग CSRF हमले में भी किया जा सकता है ताकि किसी व्यवस्थापक उपयोगकर्ता को दुर्भावनापूर्ण क्वेरी चलाने के लिए धोखा दिया जा सके। प्रभावित फ़ाइलें...

CVE-2026-2688 CM HIPAA Forms < 3.2.0 - Unauthenticated Authorization Bypass

The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints...

EUVD-2026-70037

The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints...

CVE-2026-2688 CM HIPAA Forms < 3.2.0 - Unauthenticated Authorization Bypass

The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints...

CVE-2026-2688

The HIPAA FORMS WordPress plugin (by CM) prior to version 3.2.0 contains a hardcoded authentication bypass : a fixed parameter included with all AJAX requests causes the server to skip nonce validation entirely, allowing unauthenticated attackers to access protected endpoints. The vulnerability i...

CVE-2026-16612

The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two...

CVE-2026-16612

CVE-2026-16612 affects the FiboSearch WordPress plugin prior to version 1.34.1 . The plugin fails to consistently exclude password-protected products from two unauthenticated AJAX endpoints : the autocomplete search endpoint (dgwt_wcas_ajax_search) and the Details Panel endpoint (dgwt_wcas_result...

EUVD-2026-64217

The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two...

CVE-2026-16612 FiboSearch < 1.34.1 - Unauthenticated Password-Protected Product Information Disclosure

The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two...

CVE-2026-65944

Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI 9.11.0...

CVE-2026-65946

Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI 9.11.0...

CVE-2026-65944 Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI < 9.11.0

Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI 9.11.0...

CVE-2026-65944

Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI 9.11.0...

CVE-2026-65944 Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI < 9.11.0

Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI 9.11.0...

CVE-2026-65946

CVE-2026-65946 : Joomla extension rolandd.com RO CSVI is vulnerable to XSS in AJAX endpoint handlers in versions

CVE-2026-65946

Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI 9.11.0...

EUVD-2026-50307

Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI 9.11.0...

CVE-2026-65946 Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI < 9.11.0

Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI 9.11.0...

PT-2026-65792

Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI 9.11.0...

CVE-2026-15025

The Uncanny Automator WordPress plugin (up to version 7.3.2) is affected by Missing Authorization via four AJAX endpoints (ajax_fetch_labels, segments_fetch, tags_fetch, render_contact_fields). The issue stems from missing capability checks and nonce verification in the handlers, allowing authent...