PT-2024-35124 · Tagdiv · Tagdiv Composer

Name of the Vulnerable Software and Affected Versions: tagDiv Composer plugin for WordPress versions up to, and including, 5.0 Description: The issue is related to Reflected Cross-Site Scripting via the envato code parameter due to insufficient input sanitization and output escaping within the on...

CVE-2024-8302

A vulnerability was found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. It has been rated as critical. Affected by this issue is some unknown functionality of the file /ajax/chpwd.php. The manipulation of the argument username leads to sql injection. The attack may be launched...

CVE-2024-8302

A vulnerability was found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. It has been rated as critical. Affected by this issue is some unknown functionality of the file /ajax/chpwd.php. The manipulation of the argument username leads to sql injection. The attack may be launched...

CVE-2024-8302

CVE-2024-8302 affects dingfanzu CMS (up to the latest listed build). The vulnerability exists in the /ajax/chpwd.php endpoint where the username parameter can be manipulated to trigger a SQL injection. The impact is confirmed as remote code/data access (high severity): unauthorized access to data...

CVE-2024-8301

A vulnerability was found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ajax/checkin.php. The manipulation of the argument username leads to sql injection. The attack can b...

CVE-2024-8301

A vulnerability was found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ajax/checkin.php. The manipulation of the argument username leads to sql injection. The attack can b...

CVE-2024-5857

The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the af2handelfileremove AJAX action in all versions up to, and including, 3.7.3.2. This makes it...

CVE-2024-7857

CVE-2024-7857 affects the Media Library Folders (media-library-plus) WordPress plugin. It enables second-order SQL Injection via the sort_type parameter in the mlf_change_sort_type AJAX action, in all versions up to and including 8.2.2, due to insufficient escaping and query preparation. Exploita...

Task Management System 1.0 Cross Site Request Forgery

============================================================================================================================================= | Title : Task Management System 1.0 CSRF add staff Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 128.0...

CVE-2024-42793

A Cross-Site Request Forgery CSRF vulnerability was found in Kashipara Music Management System v1.0 via a crafted request to the /music/ajax.php?action=saveuser page...

CVE-2024-7573

The Relevanssi Live Ajax Search plugin for WordPress is vulnerable to argument injection in all versions up to, and including, 2.4. This is due to insufficient validation of input supplied via POST data in the 'search' function. This makes it possible for unauthenticated attackers to inject...

CVE-2024-7573 Relevanssi Live Ajax Search <= 2.4 - Unauthenticated WP_Query Argument Injection

The Relevanssi Live Ajax Search plugin for WordPress is vulnerable to argument injection in all versions up to, and including, 2.4. This is due to insufficient validation of input supplied via POST data in the 'search' function. This makes it possible for unauthenticated attackers to inject...

CVE-2024-7573 Relevanssi Live Ajax Search <= 2.4 - Unauthenticated WP_Query Argument Injection

The Relevanssi Live Ajax Search plugin for WordPress is vulnerable to argument injection in all versions up to, and including, 2.4. This is due to insufficient validation of input supplied via POST data in the 'search' function. This makes it possible for unauthenticated attackers to inject...

CVE-2024-42793

A Cross-Site Request Forgery CSRF vulnerability was found in Kashipara Music Management System v1.0 via a crafted request to the /music/ajax.php?action=saveuser page...

CVE-2024-42793

A Cross-Site Request Forgery CSRF vulnerability was found in Kashipara Music Management System v1.0 via a crafted request to the /music/ajax.php?action=saveuser page...

CVE-2024-42793

CVE-2024-42793 affects Kashipara Music Management System v1.0. A CSRF vulnerability exists via a crafted request to /music/ajax.php?action=save_user, due to insufficient verification of the request origin. Impact is described as enabling forged malicious requests to perform sensitive operations; ...

WordPress Relevanssi Live Ajax Search Plugin <= 2.4 is vulnerable to Broken Access Control

Software Relevanssi Live Ajax Search Type Plugin Vulnerable versions = 2.4 Fixed in 2.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-7573 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 091b716b5837 Credits scottaglia Required...

PT-2024-38427 · WordPress · Relevanssi Live Ajax Search

Name of the Vulnerable Software and Affected Versions: Relevanssi Live Ajax Search plugin for WordPress versions up to, and including, 2.4 Description: The issue is due to insufficient validation of input supplied via POST data in the search function, making it possible for unauthenticated...

CVE-2024-42791

A Cross-Site Request Forgery CSRF vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=deletegenre...

WordPress ImageRecycle pdf & image compression plugin <= 3.1.14 - Cross-Site Request Forgery in Several AJAX Actions vulnerability

Cross-Site Request Forgery in Several AJAX Actions vulnerability discovered by Lucio Sá in WordPress Plugin ImageRecycle pdf & image compression versions = 3.1.14...