10767 matches found
WordPress Events Made Easy plugin < 3.1.2 - Unauthenticated Payment Bypass vulnerability
Unauthenticated Payment Bypass vulnerability discovered by Haitam Lazaar in WordPress Plugin Events Made Easy versions 3.1.2...
CVE-2026-77128
TYPO3 extension sf_event_mgt (Event management and registration) has a Broken Access Control vulnerability where the extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-res...
CVE-2026-77128 Broken Access Control in extension "Event management and registration" (sf_event_mgt)
The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires on...
CVE-2026-77128 Broken Access Control in extension "Event management and registration" (sf_event_mgt)
The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires on...
EUVD-2026-65347
The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires on...
CVE-2026-77144 Broken Access Control in extension "Events 2" (events2)
The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event managemen...
CVE-2026-77144
CVE-2026-77144 is a broken access control vulnerability in the TYPO3 extension Events 2 (events2), specifically in its frontend management plugin. The plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own, while th...
CVE-2026-77144 Broken Access Control in extension "Events 2" (events2)
The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event managemen...
CVE-2026-77145 Broken Access Control in extension "Events 2" (events2)
The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event management access could therefore modify events belonging to other organizers...
CVE-2026-77145
CVE-2026-77145 is a broken access control vulnerability in the TYPO3 extension Events 2 (events2) . The root cause is a flawed permission check in the frontend management update flow: it verified a different event than the one the request actually modified. As a result, a user with frontend event...
CVE-2026-77145 Broken Access Control in extension "Events 2" (events2)
The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event management access could therefore modify events belonging to other organizers...
TYPO3-EXT-SA-2026-026: Broken Access Control in extension "Events 2" (events2)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-026...
TYPO3-EXT-SA-2026-026: Broken Access Control in extension "Events 2" (events2)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-026...
CVE-2026-17089
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'headerformat' parameter in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-14280
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the emoptionssave function. This makes it possible for authenticated attackers, with administrator-level access and above, to...
CVE-2026-14280 Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the emoptionssave function. This makes it possible for authenticated attackers, with administrator-level access and above, to...
CVE-2026-14280
The Events Manager WordPress plugin (≤ 7.3.7.4) is vulnerable to Local File Inclusion via the em_options_save function, specifically through manipulated dbem_data[updates] array keys. An attacker with administrator-level access or above can store a malicious traversal key that is subsequently exe...
EUVD-2026-65278
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the emoptionssave function. This makes it possible for authenticated attackers, with administrator-level access and above, to...
CVE-2026-14280 Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the emoptionssave function. This makes it possible for authenticated attackers, with administrator-level access and above, to...
CVE-2026-17089 Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'headerformat' parameter in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for...