Calendar by WD <= 1.5.51 - Authenticated SQL injection

http://www.defensecode.com/advisories/DC-2017-01-017WordPressSpiderEventCalendarPluginAdvisory.pdf PoC Vulnerable POST URL: http://www.vulnerablesite.com/wpadmin/admin.php?page=SpiderCalendar=showmanageeventid=1 Vulnerable POST Body: searcheventsbytitle=a=2011-11-11=2017-11-...

Sql injection

SQL injection in the Spider Event Calendar aka spider-event-calendar plugin before 1.5.52 for WordPress is exploitable with the orderby parameter to calendarfunctions.php or widgetThemefunctions.php, related to frontend/frontendfunctions.php...

CVE-2017-7719

SQL injection in the Spider Event Calendar aka spider-event-calendar plugin before 1.5.52 for WordPress is exploitable with the orderby parameter to calendarfunctions.php or widgetThemefunctions.php, related to frontend/frontendfunctions.php...

CVE-2017-7719

SQL injection in the Spider Event Calendar aka spider-event-calendar plugin before 1.5.52 for WordPress is exploitable with the orderby parameter to calendarfunctions.php or widgetThemefunctions.php, related to frontend/frontendfunctions.php...

CVE-2017-7719

SQL injection in the Spider Event Calendar aka spider-event-calendar plugin before 1.5.52 for WordPress is exploitable with the orderby parameter to calendarfunctions.php or widgetThemefunctions.php, related to frontend/frontendfunctions.php...

CVE-2017-7719

CVE-2017-7719 : SQL injection in the WordPress plugin Spider Event Calendar (aka spider-event-calendar) before 1.5.52. An attacker can abuse the order_by parameter in the filescalendar_functions.php or widget_Theme_functions.php , related to front_end/frontend_functions.php , to execute arbitrary...

CVE-2017-7719: Improper Neutralization of Special Elements used in an SQL Command

SQL injection in the Spider Event Calendar aka spider-event-calendar plugin before 1.5.52 for WordPress is exploitable with the orderby parameter to calendarfunctions.php or widgetThemefunctions.php, related to frontend/frontendfunctions.php...

PT-2017-17905

Name of the Vulnerable Software and Affected Versions Spider Event Calendar plugin versions prior to 1.5.52 Description The issue is related to SQL injection in the Spider Event Calendar plugin for WordPress. It is exploitable through the order by parameter in files such as "calendar functions.ph...

WordPress Spider Event Calendar 1.5.51 Plugin - Blind SQL Injection Vulnerability

Exploit for php platform in category web applications ============================================= MGC ALERT 2017-003 - Original release date: April 06, 2017 - Last revised: April 10, 2017 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score...

WordPress Plugin Spider Event Calendar 1.5.51 - Blind SQL Injection

WordPress Plugin Spider Event Calendar 1.5.51 - Blind SQL Injection ============================================= MGC ALERT 2017-003 - Original release date: April 06, 2017 - Last revised: April 10, 2017 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score...

WordPress Plugin Spider Event Calendar 1.5.51 - Blind SQL Injection

============================================= MGC ALERT 2017-003 - Original release date: April 06, 2017 - Last revised: April 10, 2017 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score ============================================= I. VULNERABILITY -----------------------...

WordPress Spider Event Calendar 1.5.51 Blind SQL Injection

============================================= MGC ALERT 2017-003 - Original release date: April 06, 2017 - Last revised: April 10, 2017 - Discovered by: Manuel GarcAa CA!rdenas - Severity: 7,1/10 CVSS Base Score ============================================= I. VULNERABILITY...

WordPress Event Calendar (Spider Event Calendar) plugin <= 1.5.38 - Reflected Cross-Site Scripting (XSS) Vulnerability

Reflected Cross-Site Scripting XSS Vulnerability was found in WordPress Event Calendar Spider Event Calendar plugin in 1.5.38 version. Solution Update the plugin...

WordPress Spider Event Calendar Plugin SQL Injection Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in WordPress Spider Event Calendar plugin version 1.5.51, which can be exploited by...

Event Calender PHP Cross-Site Request Forgery Vulnerability

Event Calendar is an event calendar module for phpnuke. A cross-site request forgery vulnerability exists in the admin.php page of Event Calendar PHP version 1.5, which can be exploited by an attacker to add an administrator account or elevate privileges to an administrator account...

Event Calendar PHP 1.5 Cross Site Request Forgery Vulnerability

Exploit for php platform in category web applications input type='hidden' name='caln...

Event Calendar PHP 1.5 SQL Injection Vulnerability

Exploit for php platform in category web applications ===================================================== Event Calendar PHP 1.5 - SQL Injection ===================================================== Vendor Homepage: http://eventcalendarphp.com/ Date: 21 Oct 2016 Demo Link :...

Event Calendar PHP 1.5 Cross Site Request Forgery

"; print 'Enter Exploit...

Event Calendar PHP 1.5 SQL Injection

===================================================== Event Calendar PHP 1.5 - SQL Injection ===================================================== Vendor Homepage: http://eventcalendarphp.com/ Date: 21 Oct 2016 Demo Link : http://eventcalendarphp.com/eventcalendar/admin.php Version : 1.5 Platform...

Event Calendar PHP 1.5 - SQL Injection

Event Calendar PHP 1.5 - SQL Injection ===================================================== Event Calendar PHP 1.5 - SQL Injection ===================================================== Vendor Homepage: http://eventcalendarphp.com/ Date: 21 Oct 2016 Version : 1.5 Platform : WebApp - PHP Author:...