PT-2026-84886

This module enables AJAX updates for advanced search, facet, and search result blocks. The module doesn’t sufficiently check block access when arbitrary block IDs are submitted to its publicly accessible AJAX endpoint. This may allow an unauthenticated attacker to retrieve restricted block conten...

The vulnerability of the /custom-fields/ajax module of the Custom Fields component in the FreeScout support service management system allows a intruder to gain unauthorized access to protected information.

The vulnerability of the /custom-fields/ajax module of the Custom Fields component in the FreeScout support service management system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to...

SUSE CVE-2007-0177

Cross-site scripting XSS vulnerability in the AJAX module in MediaWiki before 1.6.9, 1.7 before 1.7.2, 1.8 before 1.8.3, and 1.9 before 1.9.0rc2, when wgUseAjax is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Notes dog a pittance latest injection vulnerability-vulnerability warning-the black bar safety net

/modules/ajax/topic.mod.php function Picajax //echo 1 1; //echo base64encodeserializearray'a'='0''; $options = array; $TopicListLogic = Load::logic'topiclist', 1; $perpagenum = $this-Post'ppnum' ? int$this-Post'ppnum' : 2 0; $cachetime = $this-Post'ctime' ? int$this-Post'ctime' : 1 0; $uid =...

Invision Power Board (IP.Board) 3.0.0b5 - Active Cross-Site Scripting Full Path Disclosure

Invision Power Board IP.Board 3.0.0b5 - Active Cross-Site Scripting Full Path Disclosure ================================================================================ Found : brainpillow Dork : "Powered By IP.Board 3.0.0 Beta 5" Visit : brainpillow.cc, forum.antichat.ru, raz0r.name Greetz:...

CVE-2007-0177: Undefined Security Weakness

Cross-site scripting XSS vulnerability in the AJAX module in MediaWiki before 1.6.9, 1.7 before 1.7.2, 1.8 before 1.8.3, and 1.9 before 1.9.0rc2, when wgUseAjax is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...