CVE-2019-20059

CVE-2019-20059 ثغرة حقن SQL في برنامج Yetishare عبر المعامل sSortDir0 - الإصدارات v3.5.2 - v4.5.4. بالإضافة إلى إمكانية استغلال هذه الثغرة من قبل مسؤول، يمكن استخدامها أيضاً في هجوم CSRF لخداع مستخدم مسؤول لتنفيذ استعلامات ضارة. الملفات المتأثرة paymentmanage.ajax.php...

CVE-2026-2688 CM HIPAA Forms < 3.2.0 - Unauthenticated Authorization Bypass

The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints...

EUVD-2026-70037

The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints...

CVE-2026-2688 CM HIPAA Forms < 3.2.0 - Unauthenticated Authorization Bypass

The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints...

CVE-2026-2688

The HIPAA FORMS WordPress plugin (by CM) prior to version 3.2.0 contains a hardcoded authentication bypass : a fixed parameter included with all AJAX requests causes the server to skip nonce validation entirely, allowing unauthenticated attackers to access protected endpoints. The vulnerability i...

CVE-2026-16612

The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two...

CVE-2026-16612

CVE-2026-16612 affects the FiboSearch WordPress plugin prior to version 1.34.1 . The plugin fails to consistently exclude password-protected products from two unauthenticated AJAX endpoints : the autocomplete search endpoint (dgwt_wcas_ajax_search) and the Details Panel endpoint (dgwt_wcas_result...

EUVD-2026-64217

The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two...

CVE-2026-16612 FiboSearch < 1.34.1 - Unauthenticated Password-Protected Product Information Disclosure

The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two...

CVE-2026-65944

Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI 9.11.0...

CVE-2026-65946

Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI 9.11.0...

CVE-2026-65944 Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI < 9.11.0

Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI 9.11.0...

CVE-2026-65944

Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI 9.11.0...

CVE-2026-65944 Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI < 9.11.0

Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI 9.11.0...

CVE-2026-65946

CVE-2026-65946 : Joomla extension rolandd.com RO CSVI is vulnerable to XSS in AJAX endpoint handlers in versions

CVE-2026-65946

Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI 9.11.0...

EUVD-2026-50307

Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI 9.11.0...

CVE-2026-65946 Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI < 9.11.0

Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI 9.11.0...

PT-2026-65792

Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI 9.11.0...

CVE-2026-15025

The Uncanny Automator WordPress plugin (up to version 7.3.2) is affected by Missing Authorization via four AJAX endpoints (ajax_fetch_labels, segments_fetch, tags_fetch, render_contact_fields). The issue stems from missing capability checks and nonce verification in the handlers, allowing authent...