197 matches found
EUVD-2021-11659
Malware in sbrugna...
EUVD-2017-2963
Malware in sbrugna...
EUVD-2020-23516
Malware in sbrugna...
EUVD-2022-4519
Malicious code in bioql PyPI...
EUVD-2024-31209
Malicious code in bioql PyPI...
EUVD-2024-53519
Malicious code in bioql PyPI...
CVE-2025-57433
The 2wcom IP-4c 2.15.5 device's web interface includes an information disclosure vulnerability. By sending a crafted POST request to a specific endpoint /cwi/ajaxrequest/getdata.php, an authenticated attacker even with a low-privileged account like guest can retrieve the hashed passwords for the...
CVE-2025-9502 Campcodes Online Loan Management System ajax.php sql injection
A weakness has been identified in Campcodes Online Loan Management System 1.0. This impacts an unknown function of the file /ajax.php?action=savepayment. Executing manipulation of the argument loanid can lead to sql injection. The attack may be launched remotely. The exploit has been made availab...
CVE-2025-6755 Game Users Share Buttons <= 1.3.0 - Authenticated (Subscriber+) Arbitrary File Deletion via themeNameId Parameter
The Game Users Share Buttons plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajaxDeleteTheme function in all versions up to, and including, 1.3.0. This makes it possible for Subscriber-level attackers to add arbitrary file paths such a...
PT-2025-27289 · WordPress · Game Users Share Buttons
Name of the Vulnerable Software and Affected Versions: Game Users Share Buttons plugin for WordPress versions up to, and including, 1.3.0 Description: The issue is related to insufficient file path validation in the ajaxDeleteTheme function, allowing Subscriber-level attackers to add arbitrary fi...
CVE-2024-32493
An issue was discovered in Znuny LTS 6.5.1 through 6.5.7 and Znuny 7.0.1 through 7.0.16 where a logged-in agent is able to inject SQL in the draft form ID parameter of an AJAX request...
CVE-2023-29200
Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these files. Users should update to Contao...
CVE-2023-6700
The Cookie Information | Free GDPR Consent Solution plugin for WordPress is vulnerable to arbitrary option updates due to a missing capability check on its AJAX request handler in versions up to, and including, 2.0.22. This makes it possible for authenticated attackers, with subscriber-level acce...
CVE-2022-48175
Rukovoditel v3.2.1 was discovered to contain a remote code execution RCE vulnerability in the component /rukovoditel/index.php?module=dashboard/ajaxrequest...
CVE-2020-35933
A Reflected Authenticated Cross-Site Scripting XSS vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a victim into submitting a tnpcrender AJAX request containing either JavaScript in an options parameter, or a base64-encoded JSON string containing...
CVE-2019-1010104
TechyTalk Quick Chat WordPress Plugin All up to the latest is affected by: SQL Injection. The impact is: Access to the database. The component is: likeescape is used in Quick-chat.php line 399. The attack vector is: Crafted ajax request...
WordPress plugin Frontend Dashboard 授权问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An authorization issue...
CVE-2024-57076
A prototype pollution in the lib.post function of ajax-request v1.2.3 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...