22 matches found
CVE-2024-3495-Poc
CVE-2024-3495-Poc CVE-2024-3495 Country State City Dropdown CF7 Accept-Encoding: gzip, deflate Accept: / Accept-Language: en-US;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko...
PT-2024-27901
Name of the Vulnerable Software and Affected Versions wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin versions up to, and including, 6.3.2 Description The issue is related to a missing capability check on several functions in the wdt ajax actions.php file, which allows...
PT-2020-15966
Name of the Vulnerable Software and Affected Versions Observium Professional, Enterprise & Community version 20.8.10631 Description The issue allows for SQL Injection due to the possibility of injecting malicious SQL statements through malformed parameter types. Specifically, sending an improper...
CVE-2020-25130: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. Sending an improper variable type of Array allows a bypass of core SQL...
CVE-2019-9787
WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS...
CVE-2019-9787
WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS...
PT-2019-5538
Name of the Vulnerable Software and Affected Versions WordPress versions prior to 5.1.1 Description The issue is related to improper filtering of comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs due to mishandled CSRF protection an...
CVE-2019-9787: Cross-Site Request Forgery (CSRF)
WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS...
CVE-2016-6897
CVE-2016-6897 describes a CSRF vulnerability in WordPress up to version 4.5.x affecting the wp_ajax_update_plugin handler in wp-admin/includes/ajax-actions.php. The issue arises from a late check_ajax_referer call, enabling remote attackers to hijack subscribers’ authentication for /dev/random re...
CVE-2016-6897
Cross-site request forgery CSRF vulnerability in the wpajaxupdateplugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the checkajaxreferer...
CVE-2016-10148: Improper Access Control
The wpajaxupdateplugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a getplugindata call before checking the updateplugins capability, which allows remote authenticated users to bypass intended read-access restrictions via the plugin parameter to...
CVE-2016-6896: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in the wpajaxupdateplugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remote authenticated users to cause a denial of service or read certain text files via a .. dot dot in the plugin parameter to wp-admin/admin-ajax.php, as...
PT-2017-7770
Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.6 Description The issue allows remote authenticated users to bypass intended read-access restrictions. This is related to the wp ajax update plugin function in wp-admin/includes/ajax-actions.php, which makes a get...
PT-2017-9053
Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.6 Description A cross-site request forgery CSRF issue exists, allowing remote attackers to hijack the authentication of subscribers for certain operations by leveraging a late call to the check ajax referer...
CVE-2016-6635
Cross-site request forgery CSRF vulnerability in the wpajaxwpcompressiontest function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option...
CVE-2016-6635
Cross-site request forgery CSRF vulnerability in the wpajaxwpcompressiontest function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option...
CVE-2016-6635: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in the wpajaxwpcompressiontest function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option...
PT-2016-7010
Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.5 Description A cross-site request forgery CSRF issue exists in the wp ajax wp compression test function, located in wp-admin/includes/ajax-actions.php, allowing remote attackers to hijack administrator...
CVE-2016-5835
WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php...
CVE-2016-5835
WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php...