2353 matches found
CVE-2023-26857: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in /admin/ajax.php?action=saveuploads of Dynamic Transaction Queuing System v1.0 allows attackers to execute arbitrary code via a crafted PHP file...
CVE-2023-26856: Improper Neutralization of Special Elements used in an SQL Command
Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/ajax.php?action=login...
MDTF < 1.3.1 - Reflected XSS
The plugin does not sanitise and escape the taxname parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged in admin open...
MDTF < 1.3.1 - Reflected XSS
The plugin does not sanitise and escape the taxname parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open...
W4 Post List < 2.4.6 - Subscriber+ Password Protected Post Content Disclosure
The plugin does not ensure that password protected posts can be accessed before displaying their content, which could allow any authenticated users to access them Setup: Create a default Post list, and create a password protected post with secret content Then, run the below command in the develop...
InPost Gallery <= 2.1.4.1 - Reflected XSS
The plugin does not sanitise and escape the imgurl parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged in admin open...
Authentication flaw
A vulnerability was found in SourceCodester Online Pizza Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file admin/ajax.php?action=saveuser of the component Password Change Handler. The manipulation leads to improper authentication. It is possible to...
CVE-2023-1460 SourceCodester Online Pizza Ordering System Password Change improper authentication
A vulnerability was found in SourceCodester Online Pizza Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file admin/ajax.php?action=saveuser of the component Password Change Handler. The manipulation leads to improper authentication. It is possible to...
CVE-2023-1460
CVE-2023-1460 concerns the SourceCodester Online Pizza Ordering System 1.0. The vulnerability lies in the Password Change Handler, specifically the file segment admin/ajax.php?action=save_user , enabling an improper authentication condition. It can be triggered remotely, withImpact described as h...
CVE-2023-1455: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in SourceCodester Online Pizza Ordering System 1.0. This vulnerability affects unknown code of the file admin/ajax.php?action=login2 of the component Login Page. The manipulation of the argument email with the input abc%40qq.com' AND SELECT 9110 FR...
CVE-2023-1460: Improper Authentication
A vulnerability was found in SourceCodester Online Pizza Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file admin/ajax.php?action=saveuser of the component Password Change Handler. The manipulation leads to improper authentication. It is possible to...
CVE-2023-1432
A vulnerability was found in SourceCodester Online Food Ordering System 2.0 and classified as critical. Affected by this issue is some unknown functionality of the file /fos/admin/ajax.php?action=savesettings of the component POST Request Handler. The manipulation leads to improper access control...
CVE-2023-1432: Improper Access Control
A vulnerability was found in SourceCodester Online Food Ordering System 2.0 and classified as critical. Affected by this issue is some unknown functionality of the file /fos/admin/ajax.php?action=savesettings of the component POST Request Handler. The manipulation leads to improper access control...
Sql injection
PrestaShop dpdfrance 6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php...
CVE-2023-1365 SourceCodester Online Pizza Ordering System ajax.php sql injection
A vulnerability was found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/ajax.php. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The...
CVE-2023-1365: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/ajax.php. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The...
CVE-2023-25207: Improper Neutralization of Special Elements used in an SQL Command
PrestaShop dpdfrance 6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php...
Shopping Cart & eCommerce Store < 5.4.3 - Admin+ LFI
The plugin does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks. 1. Login as Admin. 2. Go to wp-admin/admin.php?page=wp-easycart-products&subpage=products 3. Click on Import Products. Browse any file and click on import file. Intercept the...
PT-2023-19979 · Unknown +1 · Prestashop +1
Name of the Vulnerable Software and Affected Versions: PrestaShop versions prior to 6.1.3 DpdFrance module versions prior to 6.1.3 Description: The issue allows for SQL Injection via the "dpdfrance/ajax.php" endpoint. Recommendations: For PrestaShop versions prior to 6.1.3, update to version 6.1....