CVE-2019-14795

The toggle-the-title aka Toggle The Title plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=updatetitleoptions isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter...

CVE-2019-14790

The limb-gallery aka Limb Gallery plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter,...

CVE-2019-14795

The toggle-the-title aka Toggle The Title plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=updatetitleoptions isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter...

PT-2019-13833 · Tribulant · Tribulant Newsletters

Name of the Vulnerable Software and Affected Versions: Tribulant Newsletters plugin versions prior to 4.6.19 Description: The issue allows directory traversal with resultant remote PHP code execution. This is achieved via the subscribers11 parameter in conjunction with an exportfile=../ value in...

WordPress Plugin Download Manager 2.5 - Cross-Site Request Forgery

Exploit Title: CSRF vulnerabilities in WordPress Download Manager Plugin 2.5 Google Dork: inurl:"/wp-content/plugins/download-manager Date: 24 may, 2019 Exploit Author: Princy Edward Exploit Author Blog : https://prinyedward.blogspot.com/ Vendor Homepage: https://www.wpdownloadmanager.com/ Softwa...

WP Social Feed Gallery < 2.4.8 - CSRF & Missing Authorisation Checks

The lack of CSRF and Authorisations checks in some AJAX methods, such as qliggdismissnotice and qliggformitemdelete could allow attacker to perform unauthorised actions via actions when logged in as a low privilege user, or via CSRF attacks...

CVE-2019-14787

The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newslettersloadneweditor contentarea parameter...

CVE-2019-14793

The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmbdeletefile attachmentid parameter...

CVE-2019-14793

The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmbdeletefile attachmentid parameter...

Arbitrary file deletion

The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmbdeletefile attachmentid parameter...

CVE-2019-14793

CVE-2019-14793 concerns the WordPress WordPress Meta Box plugin (pre-4.16.3). The vulnerability enables unauthenticated? (via the description it’s difficult to confirm authentication) file deletion through an AJAX action (wp-admin/admin-ajax.php?action=rwmb_delete_file) with an attachment_id para...

PT-2019-13832 · Tribulant · Tribulant Newsletters

Name of the Vulnerable Software and Affected Versions: Tribulant Newsletters plugin versions prior to 4.6.19 Description: The issue allows for XSS attacks via the "wp-admin/admin-ajax.php?action=newsletters load new editor" API endpoint, specifically through the contentarea parameter...

PT-2019-13841 · Woocommerce · Mq-Woocommerce-Products-Price-Bulk-Edit

Name of the Vulnerable Software and Affected Versions: mq-woocommerce-products-price-bulk-edit plugin version 2.0 Description: The issue allows for XSS via the "wp-admin/admin-ajax.php?action=update options" API endpoint, specifically through the show products page limit parameter. Recommendation...

CVE-2019-12994

Server Side Request Forgery SSRF exists in Zoho ManageEngine AssetExplorer version 6.2.0 for the AJaxServlet servlet via a parameter in a URL...

CVE-2016-10805

cPanel before 57.9999.54 allows demo accounts to execute arbitrary code via ajaxmaketextsyntaxutil.pl SEC-109...

VulnCheck KEV: CVE-2019-15774

The nd-booking plugin before 2.5 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...

glpi -- Account takeover vulnerability

MITRE Corporation reports: GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an...

CVE-2019-14398

cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajaxmaketextsyntaxutil.pl SEC-498...

CVE-2019-14398

Summary (CVE-2019-14398) : cPanel prior to 80.0.5 contains an input validation/command-execution vulnerability in the ajax_maketext_syntax_util.pl component (SEC-498), enabling demo accounts to execute arbitrary code. The issue is exposed over network (no user interaction required) and has a high...

CVE-2019-14364

An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicly available subscription form using the esfpxname wp-admin/admin-ajax.php POST parameter...