PT-2013-3102

Name of the Vulnerable Software and Affected Versions openSIS versions 4.5 through 5.2 Description The issue allows remote attackers to execute arbitrary PHP code via the modname parameter in the "ajax.php" file. Recommendations For openSIS versions 4.5 through 5.2, consider restricting access to...

CVE-2013-1349: Improper Control of Generation of Code

Eval injection vulnerability in ajax.php in openSIS 4.5 through 5.2 allows remote attackers to execute arbitrary PHP code via the modname parameter...

Phototouch < 1.2.2 - Arbitrary File Upload via themify-ajax.php

The phototouch WordPress theme was affected by an Arbitrary File Upload via themify-ajax.php security vulnerability...

WordPress Theme Suco - themify-ajax.php Arbitrary File Upload

WordPress Theme Suco - themify-ajax.php Arbitrary File Upload source: https://www.securityfocus.com/bid/63836/info The Suco themes for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize...

CVE-2013-5673

SQL injection vulnerability in testimonial.php in the IndiaNIC Testimonial plugin 2.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the customquery parameter in a testimonialadd action to wp-admin/admin-ajax.php...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the IndiaNIC Testimonial plugin 2.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 add a testimonial via an iNICtestimonialsave action; 2 add a listing template via an...

PT-2013-5720

Name of the Vulnerable Software and Affected Versions IndiaNIC Testimonial plugin version 2.2 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the custom query parameter in a testimonial add action to the "wp-admin/admin-ajax.php"...

PT-2013-5719

Name of the Vulnerable Software and Affected Versions IndiaNIC Testimonial plugin version 2.2 for WordPress Description The issue allows remote attackers to hijack the authentication of administrators for various requests, including adding testimonials, listing templates, and widget templates. It...

CVE-2013-5672: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the IndiaNIC Testimonial plugin 2.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 add a testimonial via an iNICtestimonialsave action; 2 add a listing template via an...

Modoer 1.2.5 /ajax.php SQL注入漏洞

No description provided by source...

PT-2013-5292

Name of the Vulnerable Software and Affected Versions BuddyPress Extended Friendship Request plugin versions prior to 1.0.2 Description The issue allows remote attackers to inject arbitrary web script or HTML via the friendship request message parameter to the "wp-admin/admin-ajax.php" API endpoi...

Lxblog blog system variables cover the resulting injection+Getshell attached to the use of the exp-bug warning-the black bar safety net

Nonsense: lxblog is www. phpwind. net development of multi-blog system, now seems to have stopped updating! Statement: We only do the technical research, please do not illegally used, together with consequences with himself, independent of it! Text: Key file:/mod/ajaxmod.php if ! empty$POST $POST...

vBulletin 3.x / 4.x AjaxReg SQL Injection

No description provided by source. !/usr/bin/php ? vBulletin 3.x/4.x AjaxReg remote Blind SQL Injection Exploit https://lh3.googleusercontent.com/-4HcW64E57CI/ULWN9mDnK8I/AAAAAAAAABo/cc0UA9eVak/s640/11-26-2012%25206-02-5s3%2520AM.png livedemo : http://www.youtube.com/watch?v=LlKaYyJxH7E check it ...

ClipBucket 2.6 Revision 738 SQL Injection Vulnerability

ClipBucket version 2.6 revision 738 suffers from a remote SQL injection vulnerability. Product: ClipBucket Vendor: clip-bucket.com Vulnerable Versions: 2.6 Revision 738 and probably prior Tested Version: 2.6 Revision 738 Vendor Notification: November 7, 2012 Vendor Patch: November 28, 2012 Public...

vBulletin ChangUonDyU Advanced Statistics SQL Injection

Exploit Title: vBulletin ChangUonDyU Advanced Statistics - SQL Injection Vulnerability Google Dork: No Dork Date: 19/10/2012 Exploit Author: Junookyo Vendor Homepage: http://hoiquantinhoc.com Software Link:...

vBulletin ChangUonDyU Advanced Statistics SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: vBulletin ChangUonDyU Advanced Statistics - SQL Injection Vulnerability Google Dork: No Dork Date: 19/10/2012 Exploit Author: Junookyo Vendor Homepage: http://hoiquantinhoc.com Software Link:...

vBulletin ChangUonDyU Advanced Statistics - SQL Injection

vBulletin ChangUonDyU Advanced Statistics - SQL Injection Exploit Title: vBulletin ChangUonDyU Advanced Statistics - SQL Injection Vulnerability Google Dork: No Dork Date: 19/10/2012 Exploit Author: Junookyo Vendor Homepage: http://hoiquantinhoc.com Software Link:...

vBulletin ChangUonDyU Advanced Statistics - SQL Injection

Exploit Title: vBulletin ChangUonDyU Advanced Statistics - SQL Injection Vulnerability Google Dork: No Dork Date: 19/10/2012 Exploit Author: Junookyo Vendor Homepage: http://hoiquantinhoc.com Software Link:...

Sql injection

SQL injection vulnerability in ajax.php in SCORM Cloud For WordPress plugin before 1.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the active parameter. NOTE: some of these details are obtained from third party information...

CVE-2011-5216

SQL injection vulnerability in ajax.php in SCORM Cloud For WordPress plugin before 1.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the active parameter. NOTE: some of these details are obtained from third party information...