CVE-2021-42077

PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/usermanager.php username parameter. This can be used to execute SQL statements directly on the database, allowing an adversary in some cases to completely compromise the database system. It can also be...

CVE-2021-42078

The connected records confirm CVE-2021-42078 affects PHP Event Calendar (Lite edition). A persistent cross-site scripting (XSS) vulnerability exists in the /server/ajax/events_manager.php title parameter, enabling attacker-controlled script execution in the context of other users and potential de...

CVE-2021-42078

PHP Event Calendar through 2021-11-04 allows persistent cross-site scripting XSS, as demonstrated by the /server/ajax/eventsmanager.php title parameter. This can be exploited by an adversary in multiple ways, e.g., to perform actions on the page in the context of other users, or to deface the sit...

CVE-2021-42077

PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/usermanager.php username parameter. This can be used to execute SQL statements directly on the database, allowing an adversary in some cases to completely compromise the database system. It can also be...

CVE-2021-42077

CVE-2021-42077 affects PHP Event Calendar Lite edition prior to 2021-09-03. Multiple connected sources confirm an SQL injection vulnerability exploitable via the /server/ajax/user_manager.php username parameter, enabling execution of arbitrary SQL and, in some cases, bypassing login. The issue is...

PHP Event Calendar Lite Edition SQL Injection Vulnerability

Product: PHP Event Calendar Manufacturer: Kayson Group Ltd. Affected Versions: PHP Event Calendar Lite edition Tested Versions: PHP Event Calendar Lite edition Vulnerability Type: SQL injection CWE-89 Risk Level: High Solution Status: Closed Manufacturer Notification: 2021-08-09 Solution Date:...

PHP Event Calendar Lite Edition Cross Site Scripting

Advisory ID: SYSS-2021-049 Product: PHP Event Calendar Manufacturer: Kayson Group Ltd. Affected Versions: PHP Event Calendar Lite edition Tested Versions: PHP Event Calendar Lite edition Vulnerability Type: Cross-site Scripting CWE-79 Risk Level: High Solution Status: Open Manufacturer...

PHP Event Calendar Lite Edition SQL Injection

Advisory ID: SYSS-2021-048 Product: PHP Event Calendar Manufacturer: Kayson Group Ltd. Affected Versions: PHP Event Calendar Lite edition Tested Versions: PHP Event Calendar Lite edition Vulnerability Type: SQL injection CWE-89 Risk Level: High Solution Status: Closed Manufacturer Notification:...

PHP Event Calendar SQL注入漏洞

PHP Event Calendar is an open source AJAX-based multi-user modern event calendar. It is easy to integrate and fully customizable.PHP Event Calendar Lite Edition is vulnerable to SQL injection, which can be exploited by attackers to execute illegal SQL commands to obtain sensitive database data...

PHP Event Calendar Lite Edition Cross Site Scripting Vulnerability

Product: PHP Event Calendar Manufacturer: Kayson Group Ltd. Affected Versions: PHP Event Calendar Lite edition Tested Versions: PHP Event Calendar Lite edition Vulnerability Type: Cross-site Scripting CWE-79 Risk Level: High Solution Status: Open Manufacturer Notification: 2021-08-09 Public...

XO Event Calendar < 2.3.7 - Reflected Cross-Site Scripting

The plugin does not escape the selected-name parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/edit.php?posttype=xoevent=xo-event-holiday-settings&selected-name;="...

XO Event Calendar < 2.3.7 - Reflected Cross-Site Scripting

The plugin does not escape the selected-name parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue https://example.com/wp-admin/edit.php?posttype=xoevent&page=xo-event-holiday-settings&selected-name="alert/XSS/...

Event Calendar WD < 1.1.46 - Cross-Site Scripting (XSS)

The plugin was affected by a Cross-Site Scripting issue...

WordPress Event Calendar WD plugin <= 1.1.44 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability discovered in WordPress Event Calendar WD plugin versions = 1.1.44. Solution Update the WordPress Event Calendar WD plugin to the latest available version at least 1.1.45...

All-in-One Event Calendar Plugin for WordPress < 2.5.39 Cross-Site Scripting

The WordPress All-in-One Event Calendar Plugin installed on the remote host is affected by a stored Cross-Site Scripting XSS vulnerability due to improper sanitization of user-supplied input. Note that the scanner has not tested for these issues but has instead relied only on the application's...

SQL Injection in extension "Event Calender" (pits_wd_calender)

The extension fails to properly sanitize user input and is susceptible to SQL Injection...

WordPress All-in-One Event Calendar plugin <= 2.5.38 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found in WordPress All-in-One Event Calendar plugin versions = 2.5.38. Solution Update the WordPress All-in-One Event Calendar plugin to the latest available version at least 2.5.39...

Joomla SpiderCalendar 3.2.17 SQL Injection

Exploit Title : Joomla SpiderCalendar Components 3.2.17 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 25/02/2019 Vendor Homepage : web-dorado.com Software Download Link : web-dorado.com/products/joomla-calendar.html Software Information Link :...

Event Calendar 3.7.4 SQL Injection

Exploit Title: Event Calendar 3.7.4 - SQL Injection Dork: N/A Date: 2019-01-10 Exploit Author: Ihsan Sencan Vendor Homepage: http://ezcode.pt/ Software Link: https://codecanyon.net/item/event-calendar-phpmysql-plugin/19246267 Version: 3.7.4 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N...

Event Calendar 3.7.4 - 'id' SQL Injection

Exploit Title: Event Calendar 3.7.4 - SQL Injection Dork: N/A Date: 2019-01-10 Exploit Author: Ihsan Sencan Vendor Homepage: http://ezcode.pt/ Software Link: https://codecanyon.net/item/event-calendar-phpmysql-plugin/19246267 Version: 3.7.4 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N...