Ajax30 vulnerabilities
We track 5 vulnerabilities in Ajax30 products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on May 8, 2026.
Latest Ajax30 vulnerabilities
- 7.1 High severity
BraveCMS-2.0: Improper Neutralization of Input During Web Page Generation
Brave CMS is an open-source CMS. Prior to commit 6c56603, the contact form is publicly accessible (no authentication required). User-supplied message text is passed through PHP's nl2br() function, which converts newlines to <br> tags but does not escape HTML.
- 8.7 High severity
BraveCMS-2.0: Improper Neutralization of Input During Web Page Generation
Brave CMS is an open-source CMS. Prior to commit 6c56603, page and article body content entered through the CKEditor rich-text editor is stored verbatim in the database and subsequently rendered with Laravel Blade's unescaped output directive {!! !!}. Any Java
- 8.8 High severity
BraveCMS-2.0: Missing Authorization
Brave CMS is an open-source CMS. Prior to 2.0.6, this vulnerability is a missing authorization check found in the update role endpoint at routes/web.php. The POST route for /rights/update-role/{id} lacks the checkUserPermissions:assign-user-roles middleware. T
- 8.8 High severity
BraveCMS-2.0: Unrestricted Upload of File with Dangerous Type
Brave CMS is an open-source CMS. Prior to 2.0.6, an unrestricted file upload vulnerability exists in the CKEditor upload functionality. It is found in app/Http/Controllers/Dashboard/CkEditorController.php within the ckupload method. The method fails to validat
- 9.8 Critical severity
BraveCMS-2.0: Unrestricted Upload of File with Dangerous Type
Brave CMS is an open-source CMS. Prior to 2.0.6, an Unrestricted File Upload vulnerability in the CKEditor endpoint allows attackers to upload arbitrary files, including executable scripts. This may lead to Remote Code Execution (RCE) on the server, potentiall