CVE-2026-95153

An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints...

EUVD-2026-93552

An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints...

CVE-2026-95153

A vulnerability exists in Bludit CMS 3.22.0 that allows a remote attacker to obtain sensitive information . The issue is accessible via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints. No specific root cause, exploit details, or remediation steps are provided in the available docum...

CVE-2026-95153

An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints...

PT-2026-106804

An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints...

CVE-2026-96766 GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businesshours' parameter in all versions up to, and including, 2.8.183 due to insufficient input sanitization and output escaping. This make...

CVE-2026-96766 GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businesshours' parameter in all versions up to, and including, 2.8.183 due to insufficient input sanitization and output escaping. This make...

CVE-2026-96766: Improper Neutralization of Input During Web Page Generation

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businesshours' parameter in all versions up to, and including, 2.8.183 due to insufficient input sanitization and output escaping. This make...

PT-2026-95278

The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 11.8.2 via the wpbc ajax option save AJAX action. The vulnerability exists because the handle ajax save function applies per-option safeguards only to names explicitly registered...

PT-2026-93349

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save iodd parameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device...

PT-2026-93347

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save iodd parameters endpoint using operator credentials allowing execution of commands with root privileges on the device...

PT-2026-68015

Name of the Vulnerable Software and Affected Versions User Access Manager versions prior to 2.3.13 Description Authenticated attackers with subscriber-level access and above can perform a Second-Order SQL Injection. This occurs via the 'id' parameter of the wp ajax save-attachment-compat AJAX...

CVE-2026-15385

The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable t...

CVE-2026-11390

The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets in all versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2019-25738

WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers to modify WordPress options by exploiting the hcajaxsaveoption action. Attackers can send POST requests to the admin-ajax.php endpoint with the action parameter set to...

CVE-2026-8083

A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects an unknown part of the file /ajax.php?action=saveuser. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be...

CVE-2026-7408 SourceCodester Pizzafy Ecommerce System ajax.php save_menu sql injection

A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this issue is the function savemenu of the file /admin/ajax.php?action=savemenu. Performing a manipulation results in sql injection. The attack can be initiated remotely. The exploit is now public and may be...

CVE-2026-7268 SourceCodester Pizzafy Ecommerce System ajax.php save_category sql injection

A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. This impacts the function savecategory of the file /admin/ajax.php?action=savecategory. Such manipulation of the argument Name leads to sql injection. The attack may be performed from remote. The exploit has been...

CVE-2026-7194

Affected software: SourceCodester Pharmacy Sales and Inventory System 1.0. Vulnerability location: the file /ajax.php?action=save_product. Vulnerability type / root cause: manipulation of the argument ID leads to a SQL injection vulnerability. Impact / exploitation: attack can be carried out remo...

CVE-2026-7128 SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection

A security vulnerability has been detected in SourceCodester Pharmacy Sales and Inventory System 1.0. This issue affects some unknown processing of the file /ajax.php?action=savetype. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has...