Product
An unauthenticated-accessible AJAX handler in Query Wrangler versions 1.5.57 and below allows authenticated attackers to perform remote code execution via object injection and callback manipulation.