phpLDAPadmin Environmental Issues Vulnerabilities

PhpLdapAdmin is a web-based LDAP client from the individual developer of PhpLdapAdmin, which is primarily used to manage LDAP servers. An environmental issue vulnerability exists in phpLDAPadmin, which stems from an http request smuggling vulnerability in the makeHttpRequest function in...

UBUNTU-CVE-2024-37148

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in some AJAX scripts to alter another user account data and take control of it. Upgrad...

CVE-2024-37148 GLPI allows account takeover via SQL Injection in AJAX scripts

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in some AJAX scripts to alter another user account data and take control of it. Upgrad...

CVE-2024-37148 GLPI allows account takeover via SQL Injection in AJAX scripts

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in some AJAX scripts to alter another user account data and take control of it. Upgrad...

WordPress YITH WooCommerce Ajax Product Filter plugin <= 5.1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin YITH WooCommerce Ajax Product Filter versions = 5.1.0...

CVE-2024-6411

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.8.9. This is due to a lack of validation on user-supplied data in the 'pmuploadimage' AJAX action. This makes it possible for authenticated...

CVE-2024-6411

CVE-2024-6411 – ProfileGrid WordPress plugin : Privilege escalation in ProfileGrid – User Profiles, Groups and Communities was caused by lack of validation on the pm_upload_image AJAX action, allowing authenticated users with Subscriber+ access to elevate from a user to Administrator. Affected ve...

WordPress YITH WooCommerce Ajax Product Filter Plugin <= 5.1.0 is vulnerable to Cross Site Scripting (XSS)

Software YITH WooCommerce Ajax Product Filter Type Plugin Vulnerable versions = 5.1.0 Fixed in 5.2.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37943 Patch priority Medium CVSS severity Medium 5.8 Developer YITH PSID e8d179cee8c5 Credits Rafie Muhammad...

WordPress Just Custom Fields plugin <= 3.3.2 - Missing Authorization via AJAX actions vulnerability

Missing Authorization via AJAX actions vulnerability discovered by Francesco Carlucci in WordPress Plugin Just Custom Fields versions = 3.3.2...

WordPress Pricing Table plugin <= 2.0.1 - Cross-Site Request Forgery via ajax() vulnerability

Cross-Site Request Forgery via ajax vulnerability discovered by Benedictus Jovan aillesiM in WordPress Plugin Pricing Table versions = 2.0.1...

CVE-2024-6168

The Just Custom Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.2. This is due to missing or incorrect nonce validation on several AJAX function. This makes it possible for unauthenticated attackers to invoke this functionality...

CVE-2024-5856

The Comment Images Reloaded plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the cirdeleteimage AJAX action in all versions up to, and including, 2.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, ...

CVE-2024-4102

CVE-2024-4102 affects the Pricing Table plugin for WordPress. The root cause is a missing capability check in the ajax() function across versions up to and including 2.0.1, enabling authenticated attackers with subscriber-level access or higher to perform unauthorized actions such as editing pric...

CVE-2024-6168 Just Custom Fields <= 3.3.2 - Cross-Site Request Forgery via AJAX actions

The Just Custom Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.2. This is due to missing or incorrect nonce validation on several AJAX function. This makes it possible for unauthenticated attackers to invoke this functionality...

CVE-2024-6168

CVE-2024-6168 refers to a CSRF vulnerability in the WordPress plugin Just Custom Fields, affecting all versions up to 3.3.2. The issue arises from missing or incorrect nonce validation on several AJAX functions, allowing unauthenticated attackers to trick an admin into performing admin actions. C...

CVE-2024-5856 Comment Images Reloaded <= 2.2.1 - Authenticated (Subscriber+) Arbitrary Media Deletion

The Comment Images Reloaded plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the cirdeleteimage AJAX action in all versions up to, and including, 2.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, ...

CVE-2024-4100 Pricing Table <= 2.0.1 - Cross-Site Request Forgery via ajax()

The Pricing Table plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.1. This is due to missing or incorrect nonce validation on the ajax function. This makes it possible for unauthenticated attackers to perform a variety of actions related t...

CVE-2024-4100 Pricing Table <= 2.0.1 - Cross-Site Request Forgery via ajax()

The Pricing Table plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.1. This is due to missing or incorrect nonce validation on the ajax function. This makes it possible for unauthenticated attackers to perform a variety of actions related t...

CVE-2024-6167

The CVE-2024-6167 issue in the Just Custom Fields WordPress plugin is a missing capability check in several admin AJAX functions, enabling authenticated users with Subscriber-level access (and above) to invoke admin‑only functionality such as managing field groups and item visibility. Affected ve...

CVE-2024-6167 Just Custom Fields <= 3.3.2 - Missing Authorization via AJAX actions

The Just Custom Fields plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several AJAX functions in all versions up to, and including, 3.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...