Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
ajax vulnerabilities and exploits
(subscribe to this query)
6.5
CVSSv3
CVE-2023-6139
The Essential Real Estate WordPress plugin prior to 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Denial of Service attacks.
G5plus Essential Real Estate
5.4
CVSSv3
CVE-2023-6141
The Essential Real Estate WordPress plugin prior to 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Stored XSS attacks.
G5plus Essential Real Estate
8.8
CVSSv3
CVE-2023-5235
The Ovic Responsive WPBakery WordPress plugin prior to 1.2.9 does not limit which options can be updated via some of its AJAX actions, which may allow attackers with a subscriber+ account to update blog options, such as 'users_can_register' and 'default_role'....
Kutethemes Ovic Responsive Wpbakery
4.7
CVSSv3
CVE-2017-20188
A vulnerability has been found in Zimbra zm-ajax up to 8.8.1 and classified as problematic. Affected by this vulnerability is the function XFormItem.prototype.setError of the file WebRoot/js/ajax/dwt/xforms/XFormItem.js. The manipulation of the argument message leads to cross sit...
Zimbra Zm-ajax
9.8
CVSSv3
CVE-2023-7157
A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /app/ajax/sell_return_data.php. The manipulation of the argument columns[0][data] leads to sql injec...
Mayurik Free And Open Source Inventory Management System 1.0
5.4
CVSSv3
CVE-2023-50874
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Darren Cooney WordPress Infinite Scroll – Ajax Load More allows Stored XSS.This issue affects WordPress Infinite Scroll – Ajax Load More: from n/a up to and...
Connekthq Ajax Load More
5.3
CVSSv3
CVE-2023-6155
The Quiz Maker WordPress plugin prior to 6.4.9.5 does not adequately authorize the `ays_quiz_author_user_search` AJAX action, allowing an unauthenticated malicious user to perform a search for users of the system, ultimately leaking user email addresses.
Ays-pro Quiz Maker
5.4
CVSSv3
CVE-2020-36769
The Widget Settings Importer/Exporter Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp_ajax_import_widget_dataparameter AJAX action in versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping. This makes it possib...
Porternovelli Widget Settings Importer\\/exporter
6.5
CVSSv3
CVE-2023-6077
The Slider WordPress plugin prior to 3.5.12 does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the user making the request, allowing any authenticated users, such as subscriber to access the content arbitrary post such as private, draft a...
Wpfrank Slider Factory Pro
8.8
CVSSv3
CVE-2023-6035
The EazyDocs WordPress plugin prior to 2.3.4 does not properly sanitize and escape "data" parameter before using it in an SQL statement via an AJAX action, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks.
Spider-themes Eazydocs
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-4367
CVE-2024-3611
CVE-2024-4947
CVE-2024-32988
CVE-2020-35165
local file inclusion
CVE-2024-4980
bypass
malicious code
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
5
6
7
8
9
10
NEXT »