2353 matches found
GaatiTrack Courier Management System 1.0 SQL Injection Vulnerability
Exploit Title: GaatiTrack Courier Management System v1.0 - SQL Injection Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.mayurik.com/ Software Link: https://www.mayurik.com/source-code/P0998/best-courier-management-system-project-in-php Version: v1.0 Teste...
Welcart e-Commerce < 2.9.5 - Subscriber+ Arbitrary File Upload
Description The plugin does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJAX action handling such upload. As a result, any authenticated users, such as subscriber could upload arbitrary files, such as PHP on the server Setup As admin: - Go the the...
Five Star Restaurant Menu and Food Ordering < 2.4.11 - Unauthenticated PHP Object Injection
Description The plugin unserializes user input via an AJAX action available to unauthenticated users, allowing them to perform PHP Object Injection when a suitable gadget is present on the blog. Run the below command in the developer console of the web browser while being on the blog...
Awesome Support < 6.1.5 - Insufficient permission check in wpas_edit_reply
Description The plugin does not correctly authorize the wpaseditreply function, allowing users to edit posts for which they do not have permission. Log in as a subscriber and run the following code in the browser, setting the replyid to any post ID. fetch"/wp-admin/admin-ajax.php", "headers":...
CVE-2023-5423: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/ajax.php?action=confirmorder. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely...
PT-2023-32095
Name of the Vulnerable Software and Affected Versions SourceCodester Online Pizza Ordering System version 1.0 Description A critical vulnerability has been found in the SourceCodester Online Pizza Ordering System. This issue affects the file /admin/ajax.php?action=confirm order and is related to...
Cross site scripting
A vulnerability was found in UCMS 1.4.7. It has been classified as problematic. Affected is an unknown function of the file ajax.php?do=strarraylist. The manipulation of the argument strdefault leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been...
CVE-2023-5015
A vulnerability was found in UCMS 1.4.7. It has been classified as problematic. Affected is an unknown function of the file ajax.php?do=strarraylist. The manipulation of the argument strdefault leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been...
CVE-2023-5015 UCMS cross site scripting
A vulnerability was found in UCMS 1.4.7. It has been classified as problematic. Affected is an unknown function of the file ajax.php?do=strarraylist. The manipulation of the argument strdefault leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been...
CVE-2023-5015: Improper Neutralization of Input During Web Page Generation
A vulnerability was found in UCMS 1.4.7. It has been classified as problematic. Affected is an unknown function of the file ajax.php?do=strarraylist. The manipulation of the argument strdefault leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been...
PT-2023-31484
Name of the Vulnerable Software and Affected Versions UCMS version 1.4.7 Description A problematic issue has been identified, allowing for cross-site scripting through the manipulation of the strdefault argument in an unknown function of the file "ajax.php?do=strarraylist". This can be exploited...
CVE-2023-39676
FieldPopupNewsletter Prestashop Module v1.0.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the callback parameter at ajax.php...
CVE-2023-39676: Improper Neutralization of Input During Web Page Generation
FieldPopupNewsletter Prestashop Module v1.0.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the callback parameter at ajax.php...
CVE-2023-39676
The CVE-2023-39676 issue affects the FieldPopupNewsletter Prestashop Module (v1.0.0). A reflected cross-site scripting (XSS) vulnerability is triggered via the callback parameter at ajax.php, as described in multiple sources. The vulnerability is categorized with CVSS v3.1 base score 6.1 (medium)...
Prestashop Module Cross-Site Scripting Vulnerability
PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The program provides a variety of payment methods , short message alerts and product image scaling and other features . A security vulnerability exists in Prestashop Module version v1.0.0, which stems fro...
PT-2023-27067 · Prestashop · Simpleimportproduct Prestashop Module +1
Name of the Vulnerable Software and Affected Versions: FieldPopupNewsletter Prestashop Module version 1.0.0 SimpleImportProduct Prestashop Module version 1.0.0 Description: A reflected cross-site scripting XSS issue was discovered in the Prestashop modules. The vulnerability is exploited via the...
Hesk Rtl CMS 1 Cross Site Scripting
==================================================================================================================================== | Title : Hesk Rtl CMS v1 XSS Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 63.0.3 32-bit | | Vendor :...
Exploit for Open Redirect in King-Theme Kingcomposer
CVE-2022-0165 - Page Builder KingComposer WordPress Plugin - I...
