CVE-2022-1951 Core Plugin for Kitestudio Themes < 2.3.1 - Reflected Cross-Site-Scripting

The core plugin for kitestudio WordPress plugin before 2.3.1 does not sanitise and escape some parameters before outputting them back in a response of an AJAX action, available to both unauthenticated and authenticated users when a premium theme from the vendor is active, leading to a Reflected...

CVE-2022-1599 Admin Management Xtended < 2.4.5 - Post Visibility/Date/Comment Status Update via CSRF

The Admin Management Xtended WordPress plugin before 2.4.5 does not have CSRF checks in some of its AJAX actions, allowing attackers to make a logged users with the right capabilities to call them. This can lead to changes in post status draft, published, slug, post date, comment status enabled,...

CVE-2022-1599

The CVE-2022-1599 entry concerns the WordPress plugin Admin Management Xtended (before 2.4.5). The vulnerability arises from missing CSRF checks in several AJAX actions, allowing an attacker with a logged-in user with sufficient capabilities to trigger actions such as changing post status (draft/...

WordPress plugin Pricing Deals for WooCommerce SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Pricing Deals for WooCommerce plugin 2.0.2.02 and earlier versions are vulnerable to SQL...

YaySMTP < 2.2.1 - Subscriber+ Logs Disclosure

The plugin does not have capability check in an AJAX action, allowing any logged in users, such as subscriber to view the Logs of the plugin PoC @author : 0xshdax Rafshanzani Suhada @usage : python3 script.py http://localhost import requests, sys, re, json Setup here url = sys.argv1 headers =...

Copyright Proof <= 4.16 - Reflected Cross-Site-Scripting

The plugin does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting when a specific setting is enabled. PoC To make it easier to verify the vulnerability without the...

Malicious code in ajax-libz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d5a2556c88b49a6c9fc5d7adb34b58f54d397ece23c291ab6bf016e960798ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-918 Malicious code in ajax-googleapis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a79286735a82d77ea004ac63d7e093e57051ba3ed791eb403acc3ca5985b863c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ajax-googleapis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a79286735a82d77ea004ac63d7e093e57051ba3ed791eb403acc3ca5985b863c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-922 Malicious code in ajax-libz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d5a2556c88b49a6c9fc5d7adb34b58f54d397ece23c291ab6bf016e960798ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ajax-libs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a42a0d791115ba30e5e048f5af09cdaff93938a6ca4a25d5af7ae617df66b47 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-921 Malicious code in ajax-libs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a42a0d791115ba30e5e048f5af09cdaff93938a6ca4a25d5af7ae617df66b47 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-920 Malicious code in ajax-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 070b8379312b6676349ca70706e2c71839f85076c1fd7e29cfb56d46df1dd58e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ajax-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 070b8379312b6676349ca70706e2c71839f85076c1fd7e29cfb56d46df1dd58e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Gallery plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

The vulnerability of the __ajax_explorer.sgi file in D-Link DIR-645 router microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the ajaxexplorer.sgi file of the D-Link DIR-645 router microprogramming system is related to the failure to eliminate special elements used in the operating system’s processing of the QUERYSTRING parameter. Exploiting this vulnerability can allow an attacker to execute...

CVE-2022-1946

The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting issue...

CVE-2022-1946

The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting issue...

CVE-2022-1946

The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting issue...

CVE-2022-1946

The WordPress Gallery plugin before 2.0.0 contains a reflected Cross-Site Scripting vulnerability in which a parameter is not sanitized/escaped before being echoed in the AJAX response. The issue is exploitable via an AJAX action accessible to both unauthenticated and authenticated users, potenti...