CVE-2025-26399

SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patc...

CVE-2025-26399 SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability

SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patc...

SolarWinds Web Help Desk AjaxProxy Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Web Help Desk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the AjaxProxy class. The issue results from the lack of proper validation of...

📄 FreePBX SQL Injection / Remote Code Execution

This Metasploit module exploits an unauthenticated SQL injection flaw in FreePBX prior to versions 15.0.66, 16.0.89, and 17.0.3. The vulnerability lies in the /admin/ajax.php endpoint, which is accessible without authentication. Additionally, the database user created by FreePBX can schedule...

CampCodes Gym Management System SQL注入漏洞

CampCodes Gym Management System is a gym management system from CampCodes Philippines. A SQL injection vulnerability exists in CampCodes Gym Management System version 1.0, which stems from an incorrect manipulation of the parameter Username in the file /ajax.php, which could lead to a SQL injecti...

PT-2025-39152

Name of the Vulnerable Software and Affected Versions Campcodes Gym Management System version 1.0 Description A security flaw exists in Campcodes Gym Management System version 1.0. The issue involves a SQL injection that can be triggered by manipulating the Username argument in the...

SolarWinds Web Help Desk 代码问题漏洞

SolarWinds Web Help Desk is a suite of help desk and asset management software from US-based SolarWinds. The software supports centralized knowledge base, IT asset management, project and task management, and other features. A code issue vulnerability exists in SolarWinds Web Help Desk that stems...

CVE-2025-59582

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Darren Cooney Ajax Load More ajax-load-more allows Retrieve Embedded Sensitive Data.This issue affects Ajax Load More: from n/a through = 7.6.0.2...

CVE-2025-59582 WordPress Ajax Load More Plugin <= 7.6.0.2 - Sensitive Data Exposure Vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Darren Cooney Ajax Load More allows Retrieve Embedded Sensitive Data. This issue affects Ajax Load More: from n/a through 7.6.0.2...

CVE-2025-59582

CVE-2025-59582 concerns Ajax Load More (WordPress plugin). The issue is an exposed sensitive data vulnerability where an unauthorized actor could retrieve embedded sensitive data due to insufficient access control in the plugin’s Ajax handling. Affected range stated as from n/a through

CVE-2025-59582 WordPress Ajax Load More Plugin <= 7.6.0.2 - Sensitive Data Exposure Vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Darren Cooney Ajax Load More ajax-load-more allows Retrieve Embedded Sensitive Data.This issue affects Ajax Load More: from n/a through = 7.6.0.2...

WordPress Ajax Load More Plugin <= 7.6.0.2 - Sensitive Data Exposure Vulnerability

Sensitive Data Exposure Vulnerability discovered by MD ISMAIL in WordPress Plugin Ajax Load More versions = 7.6.0.2...

CVE-2025-55888

Cross-Site Scripting XSS vulnerability was discovered in the Ajax transaction manager endpoint of ARD. An attacker can intercept the Ajax response and inject malicious JavaScript into the accountName field. This input is not properly sanitized or encoded when rendered, allowing script execution i...

CVE-2025-57433

The 2wcom IP-4c 2.15.5 device's web interface includes an information disclosure vulnerability. By sending a crafted POST request to a specific endpoint /cwi/ajaxrequest/getdata.php, an authenticated attacker even with a low-privileged account like guest can retrieve the hashed passwords for the...

CVE-2025-59582: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Darren Cooney Ajax Load More ajax-load-more allows Retrieve Embedded Sensitive Data.This issue affects Ajax Load More: from n/a through = 7.6.0.2...

CVE-2025-55888

A Cross-Site Scripting (XSS) vulnerability exists in the Ajax transaction manager endpoint of the ARD service (specifically identified in ARD GEC en Ligne ). The flaw is caused by the failure to properly sanitize or encode the accountName field when rendering data from an intercepted Ajax respons...

CVE-2025-55888

Cross-Site Scripting XSS vulnerability was discovered in the Ajax transaction manager endpoint of ARD. An attacker can intercept the Ajax response and inject malicious JavaScript into the accountName field. This input is not properly sanitized or encoded when rendered, allowing script execution i...

PT-2025-39052

Name of the Vulnerable Software and Affected Versions Darren Cooney Ajax Load More versions through 7.6.0.2 Description A flaw exists in Darren Cooney Ajax Load More that allows for the retrieval of embedded sensitive data, potentially exposing sensitive system information to an unauthorized...

CVE-2025-55888: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS vulnerability was discovered in the Ajax transaction manager endpoint of ARD. An attacker can intercept the Ajax response and inject malicious JavaScript into the accountName field. This input is not properly sanitized or encoded when rendered, allowing script execution i...

WordPress plugin Ajax Load More security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, with the ability to host personal blog sites on PHP and MySQL based servers.WordPress...