219 matches found
WordPress plugin Spiffy Calendar 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Spiffy Calendar plugin 4.9.0 and earlier versions are vulnerable to an insecure direct object...
CVE-2022-29434: Authorization Bypass Through User-Controlled Key
Insecure Direct Object References IDOR vulnerability in Spiffy Plugins Spiffy Calendar = 4.9.0 at WordPress allows an attacker to edit or delete events...
PT-2022-19608
Name of the Vulnerable Software and Affected Versions Spiffy Calendar versions 4.9.0 and earlier Description The issue allows an attacker to edit or delete events due to an Insecure Direct Object References IDOR vulnerability. This vulnerability enables unauthorized access and modification of eve...
CVE-2022-25599
Cross-Site Request Forgery CSRF vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin versions = 4.9.0...
CVE-2022-25599
Cross-Site Request Forgery CSRF vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin versions = 4.9.0...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin versions = 4.9.0...
CVE-2022-25599
CVE-2022-25599 describes a CSRF vulnerability in the WordPress plugin Spiffy Calendar (versions ≤ 4.9.0) that allows an attacker to trigger event deletion due to missing token validation on the delete request. Multiple sources document the issue and confirm the affected component as the plugin’s ...
CVE-2022-25599 WordPress Spiffy Calendar plugin <= 4.9.0 - Event deletion via Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin versions = 4.9.0...
CVE-2022-25599: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin versions = 4.9.0...
PT-2022-17392
Name of the Vulnerable Software and Affected Versions Spiffy Calendar WordPress plugin versions = 4.9.0 Description A Cross-Site Request Forgery CSRF issue was found, which can lead to event deletion. Recommendations For versions = 4.9.0, update to a version higher than 4.9.0 to resolve the issue...
CVE-2022-29434
Insecure Direct Object References IDOR vulnerability in Spiffy Plugins Spiffy Calendar = 4.9.0 at WordPress allows an attacker to edit or delete events...
WordPress Spiffy Calendar plugin <= 4.9.0 - Edit/Delete event via IDOR vulnerability
Edit/Delete event via IDOR vulnerability discovered in WordPress Spiffy Calendar plugin versions = 4.9.0 by Ex.Mi Patchstack. Solution Update the WordPress Spiffy Calendar plugin to the latest available version at least 4.9.1...
Spiffy Calendar < 4.9.1 - Subscriber+ Arbitrary Event Edition/Deletion via IDOR
The plugin does not check that an event belongs to the user editing/deleting it, allowing any authenticated users to delete arbitrary one via an IDOR attack...
WordPress Spiffy Calendar plugin <= 4.9.0 - Admin+ Persistent Cross-Site Scripting (XSS) vulnerability
Admin+ Persistent Cross-Site Scripting XSS vulnerability discovered in WordPress Spiffy Calendar plugin versions = 4.9.0 by Ex.Mi Patchstack. Solution Update the WordPress Spiffy Calendar plugin to the latest available version at least 4.9.1...
WordPress Spiffy Calendar plugin <= 4.9.0 - Event deletion via Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Spiffy Calendar plugin versions = 4.9.0 by Ngo Van Thien. Solution Update the WordPress Spiffy Calendar plugin to the latest available version at least 4.9.1...
Spiffy Calendar < 4.9.1 - Arbitrary Event Deletion via CSRF
The plugin does not have CSRF check in place when deleting events, allowing attacker to make a logged in admin delete arbitrary events via a CSRF attack...
WordPress Spiffy Calendar plugin <= 4.9.0 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability
Authenticated Reflected Cross-Site Scripting XSS vulnerability discovered in WordPress Spiffy Calendar plugin versions = 4.9.0 by Ex.Mi Patchstack. Solution Update the WordPress Spiffy Calendar plugin to the latest available version at least 4.9.1...
WordPress Spiffy Calendar plugin <= 4.9.0 - Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities
Multiple Authenticated Reflected Cross-Site Scripting XSS vulnerabilities discovered in WordPress Spiffy Calendar plugin versions = 4.9.0 by Ex.Mi Patchstack. Solution Update the WordPress Spiffy Calendar plugin to the latest available version at least 4.9.1...
