CVE-2023-1421

CVE-2023-1421 describes a reflected cross-site scripting (XSS) in Mattermost’s OAuth flow completion endpoints. The vulnerability allows an attacker to induce a victim to click a crafted link with a malicious state parameter, enabling the attacker to perform AJAX requests on behalf of the victim....

CVE-2023-1421 Reflected XSS in OAuth flow completion endpoints

A reflected cross-site scripting vulnerability in the OAuth flow completion endpoints in Mattermost allows an attacker to send AJAX requests on behalf of the victim via sharing a crafted link with a malicious state parameter...

CVE-2022-38456

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ernest Marcinko Ajax Search Lite plugin = 4.10.3 versions...

CVE-2022-38456

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ernest Marcinko Ajax Search Lite plugin = 4.10.3 versions...

CVE-2022-38456

CVE-2022-38456 affects the WordPress plugin Ajax Search Lite (Ernest Marcinko) versions 4.10.3, with 4.11 explicitly cited as the fixed release. If upgrading is not immediate, mitigation should include disabling the affected Ajax path until patching.

WordPress Plugin Ernest Marcinko Ajax Search Lite 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin... An information disclosure...

PT-2023-13605 · Ernest Marcinko · Ajax Search Lite

Name of the Vulnerable Software and Affected Versions: Ernest Marcinko Ajax Search Lite plugin versions = 4.10.3 Description: The issue is related to the exposure of sensitive information to unauthorized actors. Recommendations: For Ernest Marcinko Ajax Search Lite plugin versions = 4.10.3, updat...

[SECURITY] Fedora 38 Update: guacamole-server-1.5.0-2.fc38

Guacamole is an HTML5 remote desktop gateway. Guacamole provides access to desktop environments using remote desktop protoc ols like VNC and RDP. A centralized server acts as a tunnel and proxy, allowing access to multiple desktops through a web browser. No browser plugins are needed, and no clie...

WP Basic Elements <= 5.2.15 - Cross-Site Request Forgery (CSRF)

The plugin does not protect its wpbesavesettings ajax actions against CSRF attacks, allowing an unauthenticated attacker to update the plugin settings by tricking a logged in admin to submit a crafted request...

WordPress Ajax Load More Plugin < 5.6.0.3 is vulnerable to Cross Site Scripting (XSS)

Software Ajax Load More Type Plugin Vulnerable versions 5.6.0.3 Fixed in 5.6.0.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4466 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 33d2d66c78ff Credits Lana Codes Requir...

CVE-2023-25207

PrestaShop dpdfrance 6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php...

CVE-2023-0477

The Auto Featured Image Auto Post Thumbnail WordPress plugin before 3.9.16 includes an AJAX endpoint that allows any user with at least Author privileges to upload arbitrary files, such as PHP files. This is caused by incorrect file extension validation...

CVE-2023-0037

The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2023-0477

The Auto Featured Image Auto Post Thumbnail WordPress plugin before 3.9.16 includes an AJAX endpoint that allows any user with at least Author privileges to upload arbitrary files, such as PHP files. This is caused by incorrect file extension validation...

CVE-2023-0477 Auto Featured Image < 3.9.16 - Author+ Arbitrary File Upload

The Auto Featured Image Auto Post Thumbnail WordPress plugin before 3.9.16 includes an AJAX endpoint that allows any user with at least Author privileges to upload arbitrary files, such as PHP files. This is caused by incorrect file extension validation...

bumsys SQL注入漏洞

bumsys is an open source project called Business Management System by unilogies individual developers. unilogies bumsys version before v2.0.2 has a SQL injection vulnerability , the vulnerability stems from core/ajax/ajaxdata.php in the SQL injection...

PT-2023-16932 · Unknown · Sourcecodester Online Pizza Ordering System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Pizza Ordering System version 1.0 Description: A critical issue was found in the system, affecting an unknown functionality of the file /admin/ajax.php. The manipulation of the username argument leads to SQL injection...

CVE-2023-25207

PrestaShop dpdfrance 6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php...

CVE-2023-1336

The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check on the ajaxdeactivate function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to...

CVE-2023-1336 RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'ajax_deactivate'

The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check on the ajaxdeactivate function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to...