CVE-2026-7407

The CVE-2026-7407 vulnerability affects SourceCodester Pizzafy Ecommerce System 1.0, specifically the save_settings function in /pizzafy/admin/ajax.php?action=save_settings (Setting Handler). The issue is a SQL injection caused by input manipulation in that endpoint, enabling remote attackers to ...

EUVD-2018-1908

Malware in sbrugna...

PT-2025-9069 · WordPress · Forex Calculators

Name of the Vulnerable Software and Affected Versions: Forex Calculators plugin for WordPress versions up to, and including, 1.3.5 Description: The issue allows authenticated attackers with Subscriber-level access and above to update the plugin's settings due to a missing capability check on the...

CVE-2024-7200

A vulnerability, which was classified as problematic, has been found in SourceCodester Complaints Report Management System 1.0. This issue affects some unknown processing of the file /admin/ajax.php?action=savesettings. The manipulation of the argument name leads to cross site scripting. The atta...

PT-2024-37508 · Sourcecodester · Sourcecodester Simple Online Bidding System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Online Bidding System version 1.0 Description: A critical issue affects the /admin/ajax.php?action=save settings file, where the manipulation of the img argument leads to unrestricted upload. This can be initiated...

CVE-2022-32020

Car Rental Management System v1.0 is vulnerable to Arbitrary code execution via ip/car-rental-management-system/admin/ajax.php?action=savesettings...

Ivory Search < 5.4.1 - Multiple Admin+ Stored Cross-Site Scripting

The plugin does not escape some of the Form settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. Go to the AJAX settings of a Form and put the following payload in the "Minimum number of characters required...

WordPress WP Image Zoom Access Control Error Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.WP Image Zoom is used in one of the image zoom plugin. An access control error vulnerability exists in the AJAX...

CVE-2018-1000510: Incorrect Permission Assignment for Critical Resource

WP Image Zoom version 1.23 contains a Incorrect Access Control vulnerability in AJAX settings that can result in allows anybody to cause denial of service. This attack appear to be exploitable via Can be triggered intentionally or unintentionally via CSRF by any logged in user. This vulnerability...

CVE-2013-0301: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in apps/calendar/ajax/settings/settimezone in ownCloud before 4.0.12 allows remote attackers to hijack the authentication of users for requests that change the timezone via the timezone parameter...

CVE-2013-0299: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that 1 change the timezone for the user via the lat and lng parameters to...