10001 matches found
CVE-2022-39986
A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfgid parameter in /ajax/openvpn/activateovpncfg.php and /ajax/openvpn/delovpncfg.php...
CVE-2022-39986
A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfgid parameter in /ajax/openvpn/activateovpncfg.php and /ajax/openvpn/delovpncfg.php...
CVE-2022-39987
A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via the "entity" POST parameters in /ajax/networking/getwgkey.php...
CVE-2023-3977
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handleinstallation function that is called via the inisevinstallation AJAX aciton in various versions. This makes it possible for...
CVE-2023-3977
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handleinstallation function that is called via the inisevinstallation AJAX aciton in various versions. This makes it possible for...
CVE-2023-0958
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handleinstallation function that is called via the inisevinstallation AJAX aciton in various versions. This makes it possible for authenticated attackers with...
Cross site request forgery (csrf)
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handleinstallation function that is called via the inisevinstallation AJAX aciton in various versions. This makes it possible for...
The vulnerability of the filter() and basket() functions in the Ajax Controller of the PNP4Nagios performance monitoring system for network monitoring allows a violator to execute cross-site scripting attacks.
The vulnerability of the filter and basket functions in the Ajax Controller of the PNP4Nagios performance monitoring system for network monitoring involves a lack of measures taken to protect the website structure. Exploiting this vulnerability could allow an attacker to perform cross-site...
The vulnerability of the Ajax Controller component of the PNP4Nagios network monitoring system allows a attacker to perform a CSRF attack.
The vulnerability of the Ajax Controller component in the PNP4Nagios network monitoring system is related to the manipulation of inter-site requests. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack remotely...
CVE-2023-26859
SQL injection vulnerability found in PrestaShop sendinblue v.4.0.15 and before allow a remote attacker to gain privileges via the ajaxOrderTracking.php component...
CVE-2023-26859
SQL injection vulnerability found in PrestaShop sendinblue v.4.0.15 and before allow a remote attacker to gain privileges via the ajaxOrderTracking.php component...
PT-2023-20829 · Prestashop · Prestashop Sendinblue
Name of the Vulnerable Software and Affected Versions: PrestaShop sendinblue versions 4.0.15 and earlier Description: A SQL injection issue allows a remote attacker to gain privileges via the ajaxOrderTracking.php component. Recommendations: For PrestaShop sendinblue versions 4.0.15 and earlier,...
PT-2023-8402 · WordPress · Wordpress Database Administrator
Name of the Vulnerable Software and Affected Versions: WordPress Database Administrator plugin versions 1.0.3 and earlier Description: The issue is related to a SQL injection problem. It occurs because a parameter is not properly sanitized and escaped before being used in a SQL statement via an...
WordPress Database Administrator <= 1.0.3 - Unauthenticated SQL Injection
Description The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. PoC Run the command: curl -i -s -k -X POST --data-binary...
CVE-2023-3845
A vulnerability was found in mooSocial mooDating 1.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /friends/ajaxinvite of the component URL Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The...
mooSocial mooDating 跨站脚本漏洞
mooSocial mooDating is a dating application from mooSocial. A cross-site scripting vulnerability exists in mooSocial mooDating version 1.2, which stems from a cross-site scripting XSS vulnerability in file/friends/ajaxinvite...
CVE-2023-3802
A vulnerability was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /Controller/Ajaxfileupload.ashx. The manipulation of the argument file leads to unrestricted upload. The...
WordPress Page Builder KingComposer 2.9.5 Open Redirection
==================================================================================================================================== | Title : WordPress Page Builder KingComposer 2.9.5 Open Redirect Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla...
OAuth Single Sign On – SSO (OAuth Client) < 6.23.4 - Improper Authentication
Description The plugin does not have authorisation in various AJAX actions, which could allow users with a role as low as Subscriber to call them and perform unauthorised actions...