CVE-2025-4855

The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sbencryption function in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to bypass authorization...

CampCodes Payroll Management System 注入漏洞

CampCodes Payroll Management System is a payroll management system from CampCodes Philippines. An injection vulnerability exists in CampCodes Payroll Management System version 1.0, which is caused by a SQL injection due to incorrect manipulation of the parameter ID in file/ajax.php...

CampCodes Payroll Management System 注入漏洞

CampCodes Payroll Management System is a payroll management system from CampCodes Philippines. An injection vulnerability exists in CampCodes Payroll Management System version 1.0, which is caused by a SQL injection due to incorrect manipulation of the parameter ID in file/ajax.php...

PT-2025-28804

Name of the Vulnerable Software and Affected Versions: The Support Board plugin for WordPress versions up to, and including, 3.8.0 Description: The issue allows unauthorized access, modification, or deletion of data due to the use of hardcoded default secrets in the sb encryption function. This...

CVE-2025-7128

A vulnerability has been found in Campcodes Payroll Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /ajax.php?action=calculatepayroll. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploi...

CampCodes Payroll Management System 注入漏洞

CampCodes Payroll Management System is a payroll management system from CampCodes Philippines. An injection vulnerability exists in CampCodes Payroll Management System version 1.0, which stems from improper handling of parameter IDs in the file /ajax.php, which could lead to a SQL injection attac...

CampCodes Payroll Management System 注入漏洞

CampCodes Payroll Management System is a payroll management system from CampCodes Philippines. An injection vulnerability exists in CampCodes Payroll Management System version 1.0, which stems from improper handling of parameter IDs in the file /ajax.php, which could lead to a SQL injection attac...

CampCodes Online Recruitment Management System 注入漏洞

CampCodes Online Recruitment Management System is a recruitment management system from CampCodes Philippines. An injection vulnerability exists in CampCodes Online Recruitment Management System version 1.0, which stems from improper handling of parameter IDs in the file /admin/ajax.php, which cou...

CampCodes Payroll Management System 注入漏洞

CampCodes Payroll Management System is a payroll management system from CampCodes Philippines. An injection vulnerability exists in CampCodes Payroll Management System version 1.0, which stems from improper handling of parameter IDs in the file /ajax.php, which could lead to a SQL injection attac...

CampCodes Payroll Management System 注入漏洞

CampCodes Payroll Management System is a payroll management system from CampCodes Philippines. An injection vulnerability exists in CampCodes Payroll Management System version 1.0, which stems from improper handling of the employeeid parameter in the file /ajax.php, which could lead to a SQL...

CampCodes Online Recruitment Management System 注入漏洞

CampCodes Online Recruitment Management System is a recruitment management system from CampCodes Philippines. An injection vulnerability exists in CampCodes Online Recruitment Management System version 1.0, which stems from improper handling of parameter IDs in the file /admin/ajax.php, which cou...

CampCodes Payroll Management System 安全漏洞

CampCodes Payroll Management System is a payroll management system from CampCodes Philippines. A security vulnerability exists in CampCodes Payroll Management System version 1.0, which stems from improper handling of parameter IDs in the file /ajax.php, which could lead to a SQL injection attack...

CVE-2025-6729

The PayMaster for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.4.31 via the 'wpajaxpaymstatus' AJAX action This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to...

CVE-2025-6729

The PayMaster for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.4.31 via the 'wpajaxpaymstatus' AJAX action This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to...

CVE-2025-5956

The WP Human Resource Management plugin for WordPress is vulnerable to Arbitrary User Deletion due to a missing authorization within the ajaxdeleteemployee function in versions 2.0.0 through 2.2.17. The plugin’s deletion handler reads the client-supplied $POST'delete' array and passes each ID...

CVE-2025-5692

The Lead Form Data Collection to CRM plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the /includes/LBadminajax.php file in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with...

CVE-2025-6729 PayMaster for WooCommerce <= 0.4.31 - Authenticated (Subscriber+) Server-Side Request Forgery

The PayMaster for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.4.31 via the 'wpajaxpaymstatus' AJAX action This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to...

CVE-2025-5953 WP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Privilege Escalation via wp_ajax_hrm_insert_employee AJAX Action

The WP Human Resource Management plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the ajaxinsertemployee and updateempoyee functions in versions 2.0.0 through 2.2.17. The AJAX handler reads the client-supplied $POST'role' and, after basic cleaning via...

PT-2025-27849 · WordPress · Paymaster For Woocommerce

Name of the Vulnerable Software and Affected Versions: PayMaster for WooCommerce plugin for WordPress versions up to, and including, 0.4.31 Description: The issue allows authenticated attackers with Subscriber-level access and above to make web requests to arbitrary locations originating from the...

PT-2025-27843 · WordPress · Wp Human Resource Management

Name of the Vulnerable Software and Affected Versions: WP Human Resource Management plugin versions 2.0.0 through 2.2.17 Description: The issue is related to missing authorization in the ajax insert employee and update employee functions. This allows authenticated attackers with Employee-level...