PT-2023-31749 · S Cms · S-Cms

Name of the Vulnerable Software and Affected Versions: S-CMS version 5.0 Description: The issue is related to a SQL injection vulnerability. It can be exploited via the A bbsauth parameter at the "/admin/ajax.php" API endpoint. Recommendations: For S-CMS version 5.0, consider restricting access t...

Post Meta Data Manager < 1.2.1 - Missing Authorization to Post, Term, and User Meta Deletion

Description The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification and loss of data due to missing capability checks on the pmdmwpajaxdeletemeta, pmdmwpdeleteusermeta, and pmdmwpdeleteusermeta functions hooked via nopriv AJAX actions in all versions up to, and...

Just Custom Fields <= 3.3.2 - Cross-Site Request Forgery on AJAX Actions

Description The Just Custom Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.2. This is due to missing or incorrect nonce validation on multiple AJAX actions. This makes it possible for unauthenticated attackers to create, modify, a...

CVE-2023-6077

The Slider WordPress plugin before 3.5.12 does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the user making the request, allowing any authenticated users, such as subscriber to access the content arbitrary post such as private, draft and password protect...

Essential Real Estate < 4.4.0 - Subscriber+ Stored XSS

Description The plugin does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Stored XSS attacks. PoC 1. Login with a subscriber account, and visit https://vulnerable-site.tld/wp-admin/profile.php?action=delete...

Essential Real Estate < 4.4.0 - Subscriber+ Denial of Service via Arbitrary Option Update

Description The plugin does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Denial of Service attacks. PoC 1. login, and visit https://vulnerable-site.tld/wp-admin/profile.php?action=delete 2. run the following...

Essential Real Estate < 4.4.0 - Subscriber+ Denial of Service via Arbitrary Option Update

Description The plugin does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Denial of Service attacks. 1. login, and visit https://vulnerable-site.tld/wp-admin/profile.php?action=delete 2. run the following in...

WordPress Plugin Slider Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on PHP and MySQL servers.WordPress plugin is an...

Essential Real Estate < 4.4.0 - Subscriber+ Arbitrary File Upload

Description The plugin does not properly validate uploaded files via the ajaxUploadFonts function, allowing any authenticated users, such as subscriber to upload arbitrary files...

Ovic Responsive WPBakery < 1.2.9 - Subscriber+ Option Update

Description The plugin does not limit which options can be updated via some of its AJAX actions, which may allow attackers with a subscriber+ account to update blog options, such as 'userscanregister' and 'defaultrole'. It also unserializes user input in the process, which may lead to Object...

CVE-2023-6035

The EazyDocs WordPress plugin before 2.3.4 does not properly sanitize and escape "data" parameter before using it in an SQL statement via an AJAX action, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks...

Sql injection

The EazyDocs WordPress plugin before 2.3.4 does not properly sanitize and escape "data" parameter before using it in an SQL statement via an AJAX action, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks...

Shortcoder < 6.3.1 - Subscriber+ Unauthorised AJAX Call

Description The plugin does not have proper authorisation in an AJAX action, allowing any authenticated users, such as subscriber to call it...

PT-2023-32488 · WordPress · Eazydocs

Name of the Vulnerable Software and Affected Versions: EazyDocs WordPress plugin versions prior to 2.3.4 Description: The issue arises from the improper sanitization and escaping of the data parameter before its use in an SQL statement via an AJAX action. This could allow any authenticated users ...

CVE-2023-6658

A vulnerability classified as critical was found in SourceCodester Simple Student Attendance System 1.0. This vulnerability affects unknown code of the file ajax-api.php?action=saveattendance. The manipulation of the argument classid leads to sql injection. The exploit has been disclosed to the...

CVE-2023-6658

A vulnerability classified as critical was found in SourceCodester Simple Student Attendance System 1.0. This vulnerability affects unknown code of the file ajax-api.php?action=saveattendance. The manipulation of the argument classid leads to sql injection. The exploit has been disclosed to the...

Sql injection

A vulnerability classified as critical was found in SourceCodester Simple Student Attendance System 1.0. This vulnerability affects unknown code of the file ajax-api.php?action=saveattendance. The manipulation of the argument classid leads to sql injection. The exploit has been disclosed to the...

CVE-2023-6658 SourceCodester Simple Student Attendance System sql injection

A vulnerability classified as critical was found in SourceCodester Simple Student Attendance System 1.0. This vulnerability affects unknown code of the file ajax-api.php?action=saveattendance. The manipulation of the argument classid leads to sql injection. The exploit has been disclosed to the...

CVE-2023-6658

Affected software : SourceCodester Simple Student Attendance System 1.0. Vulnerability : SQL injection in the file ajax-api.php?action=save_attendance caused by unsafely handling the class_id parameter. The exploit has been disclosed publicly. Impact : As described in the sources, this can compro...

Smart Forms < 2.6.85 - Subscriber+ Arbitrary Options Update

Description The plugin does not have authorisation in an AJAX action hooked to smartformssavesettings, and does not ensure that the option to be updated belong to the plugin. As a result, any authenticated users, such as subscriber could update arbitrary options such as defaultrole and...