13717 matches found
CVE-2024-7573
The Relevanssi Live Ajax Search plugin for WordPress is vulnerable to argument injection in all versions up to, and including, 2.4. This is due to insufficient validation of input supplied via POST data in the 'search' function. This makes it possible for unauthenticated attackers to inject...
CVE-2024-7573 Relevanssi Live Ajax Search <= 2.4 - Unauthenticated WP_Query Argument Injection
The Relevanssi Live Ajax Search plugin for WordPress is vulnerable to argument injection in all versions up to, and including, 2.4. This is due to insufficient validation of input supplied via POST data in the 'search' function. This makes it possible for unauthenticated attackers to inject...
CVE-2024-7573 Relevanssi Live Ajax Search <= 2.4 - Unauthenticated WP_Query Argument Injection
The Relevanssi Live Ajax Search plugin for WordPress is vulnerable to argument injection in all versions up to, and including, 2.4. This is due to insufficient validation of input supplied via POST data in the 'search' function. This makes it possible for unauthenticated attackers to inject...
CVE-2024-42793
A Cross-Site Request Forgery CSRF vulnerability was found in Kashipara Music Management System v1.0 via a crafted request to the /music/ajax.php?action=saveuser page...
WordPress Relevanssi Live Ajax Search Plugin <= 2.4 is vulnerable to Broken Access Control
Software Relevanssi Live Ajax Search Type Plugin Vulnerable versions = 2.4 Fixed in 2.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-7573 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 091b716b5837 Credits scottaglia Required...
CVE-2024-7573: Improper Neutralization of Argument Delimiters in a Command
The Relevanssi Live Ajax Search plugin for WordPress is vulnerable to argument injection in all versions up to, and including, 2.4. This is due to insufficient validation of input supplied via POST data in the 'search' function. This makes it possible for unauthenticated attackers to inject...
CVE-2024-42793
A Cross-Site Request Forgery CSRF vulnerability was found in Kashipara Music Management System v1.0 via a crafted request to the /music/ajax.php?action=saveuser page...
CVE-2024-42793
CVE-2024-42793 affects Kashipara Music Management System v1.0. A CSRF vulnerability exists via a crafted request to /music/ajax.php?action=save_user, due to insufficient verification of the request origin. Impact is described as enabling forged malicious requests to perform sensitive operations; ...
PT-2024-38427 · WordPress · Relevanssi Live Ajax Search
Name of the Vulnerable Software and Affected Versions: Relevanssi Live Ajax Search plugin for WordPress versions up to, and including, 2.4 Description: The issue is due to insufficient validation of input supplied via POST data in the search function, making it possible for unauthenticated...
CVE-2024-42791
A Cross-Site Request Forgery CSRF vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=deletegenre...
WordPress ImageRecycle pdf & image compression plugin <= 3.1.14 - Cross-Site Request Forgery in Several AJAX Actions vulnerability
Cross-Site Request Forgery in Several AJAX Actions vulnerability discovered by Lucio Sá in WordPress Plugin ImageRecycle pdf & image compression versions = 3.1.14...
WordPress ImageRecycle pdf & image compression plugin <= 3.1.14 - Missing Authorization in Several AJAX Actions vulnerability
Missing Authorization in Several AJAX Actions vulnerability discovered by Lucio Sá in WordPress Plugin ImageRecycle pdf & image compression versions = 3.1.14...
PT-2024-37800 · WordPress · Oxygen Builder
Name of the Vulnerable Software and Affected Versions: Oxygen Builder plugin for WordPress versions up to, and including, 4.8.3 Description: The issue is related to a missing capability check on the oxy save css from admin AJAX action. This makes it possible for authenticated attackers, with...
PT-2024-38847 · Atisolutions · Atisolutions Ciges
Name of the Vulnerable Software and Affected Versions: ATISolutions CIGES versions prior to 2.15.5 Description: The issue is a SQL injection vulnerability that allows a remote attacker to send a specially crafted SQL query to the "/modules/ajaxServiciosCentro.php" endpoint in the idCentro paramet...
CVE-2024-42788
A Stored Cross-Site Scripting (XSS) vulnerability exists in Kashipara Music Management System v1.0 within the /music/ajax.php?action=save_music endpoint. The root cause is the lack of effective filtering and escaping of user-supplied data in the title and artist parameter fields. This allows a re...
CVE-2024-42792
A Cross-Site Request Forgery CSRF vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=deleteplaylist page...
CVE-2024-42792
A Cross-Site Request Forgery CSRF vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=deleteplaylist page...
CVE-2024-6631
The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions in all versions up to, and including, 3.1.14. This makes it possible for authenticated attackers, with Subscriber-level access...
CVE-2024-6631
The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions in all versions up to, and including, 3.1.14. This makes it possible for authenticated attackers, with Subscriber-level access...