CVE-2022-38067

CVE-2022-38067 affects the WordPress plugin Totalsoft Event Calendar – Calendar (versions

PT-2022-24182 · Totalsoft · Totalsoft Event Calendar

Name of the Vulnerable Software and Affected Versions: Totalsoft Event Calendar – Calendar plugin versions 1.4.6 and earlier Description: The issue concerns an Unauthenticated Event Deletion vulnerability. Recommendations: For versions 1.4.6 and earlier, update to a version later than 1.4.6 to...

WordPress plugin Totalsoft Event Calendar – Calendar 权限许可和访问控制问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. WordPress plugin Totalsoft Event...

WordPress Event Calendar – Calendar plugin <= 1.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability discovered by Vlad Vector Patchstack in WordPress Event Calendar – Calendar plugin versions = 1.4.6. Solution Update the WordPress Event Calendar – Calendar plugin to the latest available version at least 1.4.7...

WordPress Event Calendar – Calendar plugin <= 1.4.6 - Unauthenticated Event Deletion vulnerability

Unauthenticated Event Deletion vulnerability discovered by Nguy Minh Tuan Patchstack Alliance in WordPress Event Calendar – Calendar plugin versions = 1.4.6. Solution Update the WordPress Event Calendar – Calendar plugin to the latest available version at least 1.4.7...

WordPress Spider Event Calendar plugin <= 1.5.65 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered in WordPress Spider Event Calendar plugin versions = 1.5.65 by Krzysztof Zając. Solution This plugin has been closed as of January 13, 2022 and is not available for download. This closure is permanent. Deactivate the plugin and delete it...

CVE-2021-25024

The EventCalendar WordPress plugin before 1.1.51 does not escape some user input before outputting it back in attributes, leading to Reflected Cross-SIte Scripting issues...

WordPress Event Calendar WD plugin <= 1.1.50 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Event Calendar WD plugin versions = 1.1.50. Solution Update the WordPress Event Calendar WD plugin to the latest available version at least 1.1.51...

Event Calendar < 1.1.51 - Reflected Cross-Site Scripting

The plugin does not escape some user input before outputting it back in attributes, leading to Reflected Cross-SIte Scripting issues And move the mouse over the 'Untitled' text Firefox only:...

Event Calendar < 1.1.51 - Reflected Cross-Site Scripting

The plugin does not escape some user input before outputting it back in attributes, leading to Reflected Cross-SIte Scripting issues PoC And move the mouse over the 'Untitled' text Firefox only:...

WordPress Event Calendar WD plugin <= 1.1.50 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by Krzysztof Zając in WordPress Event Calendar WD plugin versions = 1.1.50. Solution Update the WordPress Event Calendar WD plugin to the latest available version at least 1.1.51...

PHP Event Calendar SQL Injection (CVE-2021-42077)

An SQL injection vulnerability exists in PHP Event Calendar. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

PHP Event Calendar Lite Edition is vulnerable to SQL injection

PHP Event Calendar is an open source AJAX-based multi-user modern event calendar. It is easy to integrate and fully customizable.PHP Event Calendar Lite Edition is vulnerable to SQL injection, which can be exploited by attackers to execute illegal SQL commands to obtain sensitive database data...

CVE-2021-42078

PHP Event Calendar through 2021-11-04 allows persistent cross-site scripting XSS, as demonstrated by the /server/ajax/eventsmanager.php title parameter. This can be exploited by an adversary in multiple ways, e.g., to perform actions on the page in the context of other users, or to deface the sit...

CVE-2021-42078

PHP Event Calendar through 2021-11-04 allows persistent cross-site scripting XSS, as demonstrated by the /server/ajax/eventsmanager.php title parameter. This can be exploited by an adversary in multiple ways, e.g., to perform actions on the page in the context of other users, or to deface the sit...

Cross site scripting

PHP Event Calendar through 2021-11-04 allows persistent cross-site scripting XSS, as demonstrated by the /server/ajax/eventsmanager.php title parameter. This can be exploited by an adversary in multiple ways, e.g., to perform actions on the page in the context of other users, or to deface the sit...

CVE-2021-42078

PHP Event Calendar through 2021-11-04 allows persistent cross-site scripting XSS, as demonstrated by the /server/ajax/eventsmanager.php title parameter. This can be exploited by an adversary in multiple ways, e.g., to perform actions on the page in the context of other users, or to deface the sit...

CVE-2021-42077

PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/usermanager.php username parameter. This can be used to execute SQL statements directly on the database, allowing an adversary in some cases to completely compromise the database system. It can also be...

CVE-2021-42077

PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/usermanager.php username parameter. This can be used to execute SQL statements directly on the database, allowing an adversary in some cases to completely compromise the database system. It can also be...

Sql injection

PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/usermanager.php username parameter. This can be used to execute SQL statements directly on the database, allowing an adversary in some cases to completely compromise the database system. It can also be...