CVE-2020-12076

The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions. One consequence of this is stored XSS...

Cross site scripting

The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions. One consequence of this is stored XSS...

CVE-2020-12076

The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions. One consequence of this is stored XSS...

MapPress Maps < 2.53.9 - Authenticated Map Creation/Deletion Leading to Stored Cross-Site Scripting (XSS)

Both the Free and Pro versions of this plugin register AJAX actions that call functions which lack capability checks and nonce checks. It is possible for a logged-in attacker with minimal permissions, such as a subscriber, to add a map containing malicious JavaScript to an arbitrary post or page ...

MapPress Maps Pro < 2.53.9 - Remote Code Execution (RCE) due to Incorrect Access Control in AJAX Actions

The pro version of this plugin registers several AJAX actions that call functions which lack capability checks and nonce checks, specifically the ‘ajaxget’, ‘ajaxsave’, and ‘ajaxdelete’ functions in mappresstemplate.php. As such, it is possible for a logged-in attacker with minimal permissions,...

WordPress responsive-add-ons access control error vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. responsive-add-ons is a responsive loading plugin used in it. A security vulnerability exists in WordPress responsive-add-ons versions...

PT-2020-13029 · WordPress · Mappress-Google-Maps-For-Wordpress

Name of the Vulnerable Software and Affected Versions: mappress-google-maps-for-wordpress plugin versions prior to 2.53.9 Description: The issue arises from the incorrect implementation of AJAX functions with nonces or capability checks in the mappress-google-maps-for-wordpress plugin, leading to...

MapPress Maps Pro < 2.53.9 - Remote Code Execution (RCE) due to Incorrect Access Control in AJAX Actions

The pro version of this plugin registers several AJAX actions that call functions which lack capability checks and nonce checks, specifically the ‘ajaxget’, ‘ajaxsave’, and ‘ajaxdelete’ functions in mappresstemplate.php. As such, it is possible for a logged-in attacker with minimal permissions,...

Advanced Woo Search < 2.00 - SQL query leak in ajax search

Every ajax search returns the raw SQL query in the response...

Jira uses vulnerable jQuery version CVE-2015-9251

h3. Issue Summary jQuery before 3.0.0 is vulnerable to Cross-site Scripting XSS attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed. Jira uses jQuery 2.2.4 as of Jira 8.8.0 https://nvd.nist.gov/vuln/detail/CVE-2015-92...

Macs Framework 1.14f CMS - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Title: Macs Framework 1.14f CMS - Persistent Cross-Site Scripting Software Link: https://sourceforge.net/projects/macs-framework/files/latest/download CVE: N/A Document Title: =============== Macs Framework v1.14f CMS - Multiple Web...

Burp Exporter - A Burp Suite Extension To Copy A Request To The Clipboard As Multiple Programming Languages Functions

Exporter is a Burp Suite extension to copy a request to the clipboard as multiple programming languages functions. You can export as: cURL Wget Python Request Perl LWP PHP HTTPRequest2 Go Native NodeJS Request jQuery AJAX PowerShell Requirements Jython = 2.7.1 Burp Suite import In Burp Suite, und...

Accordion < 2.2.9 - Unprotected AJAX Action to Stored/Reflected XSS

This flaw allowed any authenticated user with subscriber-level and above permissions the ability to import a new accordion and inject malicious Javascript as part of the accordion. PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Host: URL Accept: / X-Requested-With: XMLHttpRequest User-Agent:...

WordPress Accordion plugin <= 2.2.8 - Unprotected AJAX Action leading to Stored/Reflected Cross-Site Scripting (XSS) vulnerability

Unprotected AJAX Action leading to Stored/Reflected Cross-Site Scripting XSS vulnerability discovered by WordFence in WordPress Accordion plugin versions = 2.2.8. Solution Update the WordPress Accordion plugin to the latest available version at least 2.2.9...

Accordion < 2.2.9 - Unprotected AJAX Action to Stored/Reflected XSS

This flaw allowed any authenticated user with subscriber-level and above permissions the ability to import a new accordion and inject malicious Javascript as part of the accordion. POST /wp-admin/admin-ajax.php HTTP/1.1 Host: URL Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0...

Responsive Poll < 1.3.4 - Broken Authentication and Missing Capability Checks on AJAX calls

Edit WPScanTeam: In versions 1.3.3, unauthenticated users can manipulate polls, e.g., delete, clone, or view a hidden poll. In versions 1.3.4 any authenticated user can do the same as above v1.3.4 added capability checks, however the issues are still exploitable via CSRF as there is no nonce chec...

Privilege escalation

An issue was discovered in ProVide formerly zFTPServer through 13.1. Privilege escalation can occur via the /ajax/SetUserInfo messages parameter because of the EXECUTE feature, which is for executing programs when certain events are triggered...

CVE-2020-11703

CVE-2020-11703 describes an HTTP Response Splitting vulnerability in ProVide (formerly zFTPServer) up to version 13.1, exploitable via /ajax/GetInheritedProperties with the language parameter. The issue arises from insufficient input handling allowing CRLF-based splitting during response construc...

CVE-2020-11705

An issue was discovered in ProVide formerly zFTPServer through 13.1. /ajax/ImportCertificate allows an attacker to load an arbitrary certificate in .pfx format or overwrite arbitrary files via the fileName parameter...

CVE-2020-11708

An issue was discovered in ProVide formerly zFTPServer through 13.1. Privilege escalation can occur via the /ajax/SetUserInfo messages parameter because of the EXECUTE feature, which is for executing programs when certain events are triggered...