Design/Logic Flaw

A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the calendar's edit event modal popup, so logged in non-guest users could view unauthorised calendar events. Note: It was read-only access, user...

CVE-2019-3848

A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the calendar's edit event modal popup, so logged in non-guest users could view unauthorised calendar events. Note: It was read-only access, user...

CVE-2019-3848

A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the calendar's edit event modal popup, so logged in non-guest users could view unauthorised calendar events. Note: It was read-only access, user...

CVE-2019-3848

A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the calendar's edit event modal popup, so logged in non-guest users could view unauthorised calendar events. Note: It was read-only access, user...

CVE-2019-3848

CVE-2019-3848 affects Moodle versions prior to 3.6.3, 3.5.5, and 3.4.8. The issue arises from permissions not being correctly checked before loading calendar event information in the calendar edit modal, allowing logged-in non-guest users to view unauthorised calendar events (read-only; no edits)...

PT-2019-16742 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle versions prior to 3.6.3 Moodle versions prior to 3.5.5 Moodle versions prior to 3.4.8 Description: A vulnerability was found where permissions were not correctly checked before loading event information into the calendar's edit event...

CVE-2018-20556

SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the bookingid parameter...

CVE-2018-20556

SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the bookingid parameter...

Sql injection

SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the bookingid parameter...

MyBB Upcoming Events Plugin 1.32 - Cross-Site Scripting

Exploit Title: MyBB Upcoming Events Plugin 1.32 - Cross-Site Scripting Date: 3/8/2019 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=1231 Version: 1.32 Tested on: Ubuntu 18.04 CVE: CVE-2019-9650 1. Description: This plugin...

MyBB Upcoming Events 1.32 Cross Site Scripting

Exploit Title: MyBB Upcoming Events Plugin 1.32 - Cross-Site Scripting Date: 3/8/2019 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=1231 Version: 1.32 Tested on: Ubuntu 18.04 CVE: CVE-2019-9650 1. Description: This plugin...

MyBB Upcoming Events Plugin 1.32 - Cross-Site Scripting

MyBB Upcoming Events Plugin 1.32 - Cross-Site Scripting Exploit Title: MyBB Upcoming Events Plugin 1.32 - Cross-Site Scripting Date: 3/8/2019 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=1231 Version: 1.32 Tested on: Ubuntu...

CVE-2018-20556

SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the bookingid parameter...

CVE-2018-20556

CVE-2018-20556 is a SQL injection vulnerability in the WordPress plugin Booking Calendar (version 8.4.3). The flaw allows an attacker to manipulate the booking_id parameter to execute arbitrary SQL commands on the underlying database, potentially exposing data. Multiple connected sources corrobor...

SOGo < 3.1.3 Multiple XSS Vulnerabilities

Multiple cross-site scripting XSS vulnerabilities in the View Raw Source page in the Web Calendar in SOGo allow remote attackers to inject arbitrary web script or HTML via the Description, Location, URL or Title field. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be...

The Events Calendar < 4.8.2 - XSS

The The Events Calendar WordPress plugin was affected by a XSS security vulnerability...

Joomla SpiderCalendar 3.2.17 SQL Injection

Exploit Title : Joomla SpiderCalendar Components 3.2.17 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 25/02/2019 Vendor Homepage : web-dorado.com Software Download Link : web-dorado.com/products/joomla-calendar.html Software Information Link :...

February 19, 2019—KB4487016 (Preview of Monthly Rollup)

None None...

Typo3 Calendar Base tx_pxkalender_pi1 2.0.0 Database Disclosure / SQL Injection

Exploit Title : Typo3 Calendar Base txpxkalenderpi1 2.0.0 SQL Injection / Database Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 18/02/2019 Vendor Homepage : typo3.org Software Download Link : extensions.typo3.org/extension/download/cal/2.0.0/zip/...

WordPress Booking Calendar 8.4.3 Plugin - Authenticated SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Booking Calendar v8.4.3 - Authenticated SQL Injection Vulnerability Exploit Author: B0UG Vendor Homepage: https://wpbookingcalendar.com/ Software Link: https://wordpress.org/plugins/booking/ Version: Tested on version...