CVE-2024-33471

An issue in the Sensor Settings of AVTECH Room Alert 4E v4.4.0 allows attackers to gain access to SMTP credentials in plaintext via a crafted AJAX request. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

CVE-2025-1185

A vulnerability was found in pihome-shc PiHome 2.0. It has been classified as critical. This affects an unknown part of the file /ajax.php?Ajax=GetModalSensorGraph. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the publi...

CVE-2025-1184

A vulnerability was found in pihome-shc PiHome 1.77 and classified as critical. Affected by this issue is some unknown functionality of the file /ajax.php?Ajax=GetModalMQTTEdit. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been...

CVE-2024-13769

The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the 'themeoptionsajaxpostaction' AJAX action in all versions up to, and including, 4.2.4. This makes it possible for...

PT-2025-6441 · WordPress · The Puzzles | Wp Magazine / Review With Store Wordpress Theme + Rtl

Name of the Vulnerable Software and Affected Versions: The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress versions up to, and including, 4.2.4 Description: The issue is related to a missing capability check on the theme options ajax post action AJAX action,...

CVE-2025-1184: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in pihome-shc PiHome 1.77 and classified as critical. Affected by this issue is some unknown functionality of the file /ajax.php?Ajax=GetModalMQTTEdit. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been...

PT-2025-6438

Name of the Vulnerable Software and Affected Versions The Click Mag - Viral WordPress News Magazine/Blog Theme theme for WordPress version 3.6.0 and earlier Description The issue is related to a missing capability check on the propanel of ajax callback function, which allows authenticated attacke...

CVE-2025-1185: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in pihome-shc PiHome 2.0. It has been classified as critical. This affects an unknown part of the file /ajax.php?Ajax=GetModalSensorGraph. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the publi...

CVE-2025-1116

A vulnerability, which was classified as critical, has been found in Dreamvention Live AJAX Search Free up to 1.0.6 on OpenCart. Affected by this issue is the function searchresults/search of the file /?route=extension/livesearch/module/livesearch.searchresults. The manipulation of the argument...

CVE-2025-1116

A vulnerability, which was classified as critical, has been found in Dreamvention Live AJAX Search Free up to 1.0.6 on OpenCart. Affected by this issue is the function searchresults/search of the file /?route=extension/livesearch/module/livesearch.searchresults. The manipulation of the argument...

CVE-2025-1116 Dreamvention Live AJAX Search Free live_search.searchresults search sql injection

A vulnerability, which was classified as critical, has been found in Dreamvention Live AJAX Search Free up to 1.0.6 on OpenCart. Affected by this issue is the function searchresults/search of the file /?route=extension/livesearch/module/livesearch.searchresults. The manipulation of the argument...

CVE-2025-1116

Dreamvention Live AJAX Search Free for OpenCart up to version 1.0.6 is affected by a SQL injection in the searchresults/search endpoint (/?route=extension/live_search/module/live_search.searchresults) via the keyword parameter. Multiple connected sources confirm remote exploitation and public dis...

CVE-2024-57076

A prototype pollution in the lib.post function of ajax-request v1.2.3 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2025-1116: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability, which was classified as critical, has been found in Dreamvention Live AJAX Search Free up to 1.0.6 on OpenCart. Affected by this issue is the function searchresults/search of the file /?route=extension/livesearch/module/livesearch.searchresults. The manipulation of the argument...

CVE-2021-4365

The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to, and including, 18.2. This is due to lacking authentication protections and santisation all on the wpfmeditfiletitledesc AJAX action. This makes it possible for...

CVE-2021-39333

The Hashthemes Demo Importer Plugin = 1.1.1 for WordPress contained several AJAX functions which relied on a nonce which was visible to all logged-in users for access control, allowing them to execute a function that truncated nearly all database tables and removed the contents of...

CVE-2022-3776

The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.1. This is due to missing or incorrect nonce validation on several functions called via AJAX actions such as formsaction, setoption...

CVE-2022-1749

The WPMK Ajax Finder WordPress plugin is vulnerable to Cross-Site Request Forgery via the createpluginatfadminsettingpage function found in the /inc/config/create-plugin-config.php file due to a missing nonce check which allows attackers to inject arbitrary web scripts, in versions up to and...

CVE-2022-1329

The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the /core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading malicious files...

CVE-2022-1654

Jupiter Theme = 6.10.1 and JupiterX Core Plugin = 2.0.7 allow any authenticated attacker, including a subscriber or customer-level attacker, to gain administrative privileges via the "abbuninstalltemplate" both and "jupiterxcorecpuninstalltemplate" JupiterX Core Only AJAX actions...