CVE-2024-8619: Improper Neutralization of Input During Web Page Generation

The Ajax Search Lite WordPress plugin before 4.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-6809: Improper Neutralization of Special Elements used in an SQL Command

The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2024-6159: Improper Neutralization of Special Elements used in an SQL Command

The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2024-11140: Improper Neutralization of Input During Web Page Generation

The Real WP Shop Lite Ajax eCommerce Shopping Cart WordPress plugin through 2.0.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for exampl...

WordPress plugin Ajax Search Lite 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-21484 · Git +1 · Jetpack +1

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue allows administrators to make GET requests to arbitrary URLs through the 'wp ajax boost proxy ig' action. Recommendations: At the moment, there is no information about a newer...

CVE-2025-3600

In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may lead to an unhandled exception resulting in a crash of the hosting process and denial of service...

CVE-2025-3600 Unsafe Reflection Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may lead to an unhandled exception resulting in a crash of the hosting process and denial of service...

CVE-2025-3600

CVE-2025-3600 affects Progress Telerik UI for ASP.NET AJAX, versions 2011.2.712 to 2025.1.218, due to an unsafe reflection vulnerability that may cause an unhandled exception, crashing the hosting process and leading to denial of service. Public sources (NVD/Red Hat/Nessus references) confirm the...

CVE-2025-4520

The Uncanny Automator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in versions up to, and including, 6.4.0.2. This makes it possible for authenticated attackers, with subscriber-level permissions or above to...

CVE-2025-4520

CVE-2025-4520 : The Uncanny Automator WordPress plugin (versions up to and including 6.4.0.2) has a missing capability check on multiple AJAX functions, enabling authenticated users with subscriber-level permissions or higher to update plugin settings. Public exploitation details are not provided...

WordPress Ajax Load More plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress Ajax Load More plugin, which stems from the application's lack of effective filtering and escaping of user-supplied...

PT-2025-21164

Name of the Vulnerable Software and Affected Versions Progress Telerik UI for AJAX versions 2011.2.712 through 2025.1.218 Description An unsafe reflection issue exists in Progress Telerik UI for AJAX. This flaw can lead to an unhandled exception, potentially causing a crash of the hosting process...

PT-2025-21134 · WordPress · Uncanny Automator

Name of the Vulnerable Software and Affected Versions: Uncanny Automator plugin for WordPress versions up to, and including, 6.4.0.2 Description: The issue is related to a missing capability check on multiple AJAX functions, allowing authenticated attackers with subscriber-level permissions or...

CVE-2025-4520: Missing Authorization

The Uncanny Automator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in versions up to, and including, 6.4.0.2. This makes it possible for authenticated attackers, with subscriber-level permissions or above to...

CVE-2025-3600: Use of Externally-Controlled Input to Select Classes or Code

In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may lead to an unhandled exception resulting in a crash of the hosting process and denial of service...

WordPress plugin Frontend Dashboard 授权问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An authorization issue...

PT-2025-20665 · Unknown · Lylme Spage

Name of the Vulnerable Software and Affected Versions: LyLme Spage version 2.1 Description: A critical issue was found in LyLme Spage, affecting an unknown part of the file lylme spage/blob/master/admin/ajax link.php. The manipulation of the sort argument leads to SQL injection. It is possible to...

LyLme Spage 注入漏洞

LyLme Spage Six Zero navigation page is China Six Zero LyLme open source a navigation page . Dedicated to simple and efficient advertising-free Internet navigation and search portal , support for background links , custom search engine , precipitation of the most valuable links , no commercial...

CVE-2025-43926

An issue was discovered in Znuny through 6.5.14 and 7.x through 7.1.6. Custom AJAX calls to the AgentPreferences UpdateAJAX subaction can be used to set user preferences with arbitrary keys. When fetching user data via GetUserData, these keys and values are retrieved and given as a whole to other...