CVE-2022-28590

CVE-2022-28590 affects Pixelimity 1.0. The vulnerability enables remote code execution via admin/admin-ajax.php?action=install_theme. Multiple sources describe an arbitrary file upload path that can lead to code execution, with public PoC showing webshell upload to facilitate further access. The ...

CVE-2022-28590: Undefined Security Weakness

A Remote Code Execution RCE vulnerability exists in Pixelimity 1.0 via admin/admin-ajax.php?action=installtheme...

PT-2022-2479

Name of the Vulnerable Software and Affected Versions Pixelimity version 1.0 Description A Remote Code Execution RCE issue exists due to the lack of input data sanitization. This allows a remote attacker to execute arbitrary code through the "admin/admin-ajax.php?action=install theme" endpoint. T...

PT-2022-13435

Name of the Vulnerable Software and Affected Versions Donations WordPress plugin versions prior to 1.8 Description The issue arises from the lack of sanitization and escaping of the nd donations id parameter in SQL statements. This occurs via the /wp-admin/admin-ajax.php AJAX action, specifically...

Contao core SQL Injection Vulnerability

Contao core prior to 2.11.4 has a SQL injection vulnerability in contao-2.11.3\system\modules\backend\Ajax.php...

GHSA-9JQ2-JVWC-P52F Contao core SQL Injection Vulnerability

Contao core prior to 2.11.4 has a SQL injection vulnerability in contao-2.11.3\system\modules\backend\Ajax.php...

zbzcms SQL Injection Vulnerability (CNVD-2022-30430)

zbzcms Station Helper CMS is a content management website of China Station Helper CMS zbzcms Inc. zbzcms version 1.0 has a SQL injection vulnerability, which originates from a SQL injection vulnerability found through the id parameter of /php/ajax.php. No detailed vulnerability details are...

CVE-2022-27129

An arbitrary file upload vulnerability at /admin/ajax.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-27125

zbzcms v1.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the neirong parameter at /php/ajax.php...

Design/Logic Flaw

An arbitrary file upload vulnerability at /admin/ajax.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-27125

zbzcms v1.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the neirong parameter at /php/ajax.php...

CVE-2022-27125

CVE-2022-27125 affects zbzcms v1.0, with a stored cross-site scripting (XSS) vulnerability exploitable via the neirong parameter in /php/ajax.php. The NVD entry lists potential impact as partial integrity and low confidentiality, with CVSSv3.1 base score 6.1 (NETWORK, LOW ATTACK COMPLEXITY, USER ...

CVE-2022-27127

zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php/ajax.php...

CVE-2022-27129

CVE-2022-27129 affects zbzcms v1.0, where an arbitrary file upload vulnerability in /admin/ajax.php can be exploited to execute arbitrary PHP code via a crafted file. The issue enables remote code execution with no authentication and minimal prerequisites, as indicated by the associated CVSS data...

CVE-2022-27127: Improper Neutralization of Special Elements used in an SQL Command

zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php/ajax.php...

CVE-2022-27125: Improper Neutralization of Input During Web Page Generation

zbzcms v1.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the neirong parameter at /php/ajax.php...

CVE-2022-27129: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability at /admin/ajax.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

PT-2022-18234

Name of the Vulnerable Software and Affected Versions zbzcms version 1.0 Description A stored cross-site scripting XSS issue was found in zbzcms. The issue is related to the neirong parameter at the "/php/ajax.php" API endpoint. This allows for potential malicious script execution. Recommendation...

PT-2022-18238

Name of the Vulnerable Software and Affected Versions zbzcms version 1.0 Description The issue allows attackers to execute arbitrary code via a crafted PHP file, exploiting an arbitrary file upload vulnerability at the /admin/ajax.php endpoint. Recommendations For zbzcms version 1.0, as a tempora...

PT-2022-18236

Name of the Vulnerable Software and Affected Versions zbzcms version 1.0 Description A SQL injection issue was found in zbzcms via the id parameter at the "/php/ajax.php" API endpoint. Recommendations For zbzcms version 1.0, avoid using the id parameter in the "/php/ajax.php" API endpoint until t...