WordPress Elegant Calendar Lite – WordPress Events Calendar Plugin plugin < 1.5.8 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Elegant Calendar Lite – WordPress Events Calendar Plugin plugin versions 1.5.8. Solution Update the WordPress Elegant Calendar Lite – WordPress Events Calendar Plugin plugin to the latest available version at least 1.5.8...

WordPress The Events Calendar plugin < 5.14.0.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress The Events Calendar plugin versions 5.14.0.4. Solution Update the WordPress The Events Calendar plugin to the latest available version at least 5.14.0.4...

WordPress The Events Calendar plugin < 5.14.0.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress The Events Calendar plugin versions 5.14.0.4. Solution Update the WordPress The Events Calendar plugin to the latest available version at least 5.14.0.4...

WordPress Subscriber Addons for The Events Calendar plugin < 2.0.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Subscriber Addons for The Events Calendar plugin versions 2.0.1. Solution Update the WordPress Subscriber Addons for The Events Calendar plugin to the latest available version at least 2.0.1...

Modern Events Calendar Lite < 6.4.0 - Contributor+ Stored Cross Site Scripting

The plugin does not sanitize and escape some of the Hourly Schedule parameters which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks PoC As a contributor, create/edit an Event, add the following payload in a "Hourly Schedule" title, as well as an...

WordPress The Events Calendar plugin < 5.14.0.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress The Events Calendar plugin versions 5.14.0.4. Solution Update the WordPress The Events Calendar plugin to the latest available version at least 5.14.0.4...

WordPress Past Events Extension plugin <= 1.0.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Past Events Extension plugin versions = 1.0.1. Solution No patched version available...

WordPress Events Calendar Registration plugin <= 1.9.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Events Calendar Registration plugin versions = 1.9.2. Solution No patched version available...

WordPress The Events Calendar plugin < 5.14.0.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress The Events Calendar plugin versions 5.14.0.4. Solution Update the WordPress The Events Calendar plugin to the latest available version at least 5.14.0.4...

Modern Events Calendar Lite < 6.4.0 - Contributor+ Stored Cross Site Scripting

The plugin does not sanitize and escape some of the Hourly Schedule parameters which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks As a contributor, create/edit an Event, add the following payload in a "Hourly Schedule" title, as well as any of...

WordPress Bulk Edit Events – Create Events in a Bulk Editor plugin < 1.1.9 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Bulk Edit Events – Create Events in a Bulk Editor plugin versions 1.1.9. Solution Update the WordPress Bulk Edit Events – Create Events in a Bulk Editor plugin to the latest available version at least...

WordPress Past Events Extension plugin <= 1.0.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Past Events Extension plugin versions = 1.0.1. Solution No patched version available...

WordPress Events Calendar Registration plugin <= 1.9.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Events Calendar Registration plugin versions = 1.9.2. Solution No patched version available...

WordPress Bulk Edit Events – Create Events in a Bulk Editor plugin < 1.1.9 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Bulk Edit Events – Create Events in a Bulk Editor plugin versions 1.1.9. Solution Update the WordPress Bulk Edit Events – Create Events in a Bulk Editor plugin to the latest available version at least 1.1.9...

WordPress Modern Events Calendar Lite plugin <= 6.3.0 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Rohan Chaudhari in WordPress Modern Events Calendar Lite plugin versions = 6.3.0. Solution Update the WordPress Modern Events Calendar Lite plugin to the latest available version at least 6.4.0...

WordPress Slider Addons for The Events Calendar plugin < 1.0.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Slider Addons for The Events Calendar plugin versions 1.0.1. Solution Update the WordPress Slider Addons for The Events Calendar plugin to the latest available version at least 1.0.1...

Business Logic Errors

Description In Dolibarr v14.0.5, any low privileged users could update their login name which should only be updated by admin. Proof of Concept POST /dolibarr/user/card.php?id=2 HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:97.0 Gecko/20100101 Firefox/97.0...

CVE-2021-46701

PreMiD 2.2.0 allows unintended access via the websocket transport. An attacker can receive events from a socket and emit events to a socket, potentially interfering with a victim's "now playing" status on Discord...

CVE-2017-15710

creationtimestamp| type| source ---|---|--- 2022-02-18 16:23:37+00:00| seen| https://t.me/cyberdenteam/354 2022-06-01 15:53:21+00:00| seen| Telegram/oy0dbBE7nfsKRAHLSCKnQ1rQ2k7lu2BiCitRs7pe50X7S8...

CVE-2018-1312

creationtimestamp| type| source ---|---|--- 2022-02-18 16:23:37+00:00| seen| https://t.me/cyberdenteam/354 2022-06-01 15:53:21+00:00| seen| Telegram/oy0dbBE7nfsKRAHLSCKnQ1rQ2k7lu2BiCitRs7pe50X7S8...