8732 matches found
CVE-2022-2846
The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event, and is also lacking sanitisation as well as escaping in some of the event fields. This could allow unauthenticated attackers to create arbitrary events and...
CVE-2022-2844
A vulnerability classified as problematic has been found in MotoPress Timetable and Event Schedule up to 1.4.06. This affects an unknown part of the file /wp/?cpmvcid=1&cpmvcdoaction=mvparse&f=datafeed&calid=1&monthindex=1&method=adddetails&id=2 of the component Calendar Handler. The manipulation...
CVE-2022-2844
A vulnerability classified as problematic has been found in MotoPress Timetable and Event Schedule up to 1.4.06. This affects an unknown part of the file /wp/?cpmvcid=1&cpmvcdoaction=mvparse&f=datafeed&calid=1&monthindex=1&method=adddetails&id=2 of the component Calendar Handler. The manipulation...
CVE-2022-2844 MotoPress Timetable and Event Schedule Calendar cross site scripting
A vulnerability classified as problematic has been found in MotoPress Timetable and Event Schedule up to 1.4.06. This affects an unknown part of the file /wp/?cpmvcid=1&cpmvcdoaction=mvparse&f=datafeed&calid=1&monthindex=1&method=adddetails&id=2 of the component Calendar Handler. The manipulation...
CVE-2022-2844
CVE-2022-2844 affects MotoPress Timetable and Event Schedule up to 1.4.06. Affects the Calendar Handler component; manipulating Subject/Location/Description via the vulnerable endpoint (the file path in the Description) enables cross-site scripting. Exploitation is described as possible to initia...
Calendar Event Multi View < 1.4.07 - Unauthenticated Arbitrary Event Creation to Stored XSS
The plugin does not have any authorisation and CSRF checks in place when creating an event, and is also lacking sanitisation as well as escaping in some of the event fields. This could allow unauthenticated attackers to create arbitrary events and put Cross-Site Scripting payloads in it. PoC As a...
PT-2022-19030 · Motopress · Motopress Timetable/Event Schedule
Name of the Vulnerable Software and Affected Versions: MotoPress Timetable and Event Schedule versions up to 1.4.06 Description: A vulnerability has been found in the Calendar Handler component of MotoPress Timetable and Event Schedule. The issue affects an unknown part of the file "/wp/?cpmvc...
WordPress plugin Calendar Event Multi View 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...
CVE-2022-2846
The CVE-2022-2846 concerns the Calendar Event Multi View WordPress plugin prior to version 1.4.07. Root cause: missing authorization, CSRF protections, and insufficient sanitisation/escaping in event creation fields. Impact: unauthenticated attackers can create arbitrary events and inject Cross-S...
Calendar Event Multi View < 1.4.07 - Unauthenticated Arbitrary Event Creation to Stored XSS
The plugin does not have any authorisation and CSRF checks in place when creating an event, and is also lacking sanitisation as well as escaping in some of the event fields. This could allow unauthenticated attackers to create arbitrary events and put Cross-Site Scripting payloads in it. As an...
CVE-2022-2314
The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site...
CVE-2022-2314
The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site...
CVE-2022-2314
The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site...
Design/Logic Flaw
The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site...
CVE-2022-2314 VR Calendar < 2.3.2 - Unauthenticated Arbitrary Function Call
The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site...
CVE-2022-2314
The CVE-2022-2314 case concerns the WordPress VR Calendar plugin (versions up to and including 2.3.2). Affected component: VR Calendar WordPress plugin; root cause: unauthenticated arbitrary PHP function calls, enabling remote code execution. Impact stated across sources: attacker can execute arb...
PT-2022-15878 · WordPress · Vr Calendar
Name of the Vulnerable Software and Affected Versions: VR Calendar WordPress plugin versions prior to 2.3.3 Description: The issue allows any user to execute arbitrary PHP functions on the site. This can lead to unauthorized access and potential code execution. Recommendations: For versions prior...
WordPress plugin VR Calendar 操作系统命令注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An operating system command injection...
CVE-2022-27617
Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users to download arbitrary files via unspecified vectors...
CVE-2022-27617
Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users to download arbitrary files via unspecified vectors...