CVE-2022-3336

The Event Monster WordPress plugin (versions prior to 1.2.0) is vulnerable to Cross-Site Request Forgery (CSRF) when deleting visitors due to missing CSRF checks. This could allow a logged-in administrator to delete arbitrary visitors via a CSRF attack. Root cause: lack of CSRF verification in th...

CVE-2022-3720 Event Monster < 1.2.1 - Admin+ SQLi

The Event Monster WordPress plugin before 1.2.0 does not validate and escape some parameters before using them in SQL statements, which could lead to SQL Injection exploitable by high privilege users...

CVE-2022-3720 Event Monster < 1.2.1 - Admin+ SQLi

The Event Monster WordPress plugin before 1.2.0 does not validate and escape some parameters before using them in SQL statements, which could lead to SQL Injection exploitable by high privilege users...

CVE-2022-3336 Event Monster < 1.2.0 - Visitors Deletion via CSRF

The Event Monster WordPress plugin before 1.2.0 does not have CSRF check when deleting visitors, which could allow attackers to make logged in admin delete arbitrary visitors via a CSRF attack...

WordPress plugin Event Monster SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

PT-2022-23869 · WordPress · Event Monster

Name of the Vulnerable Software and Affected Versions: Event Monster WordPress plugin versions prior to 1.2.0 Description: The issue is related to the lack of validation and escaping of certain parameters before they are used in SQL statements, which could lead to SQL Injection. This can be...

CVE-2022-3720

The Event Monster WordPress plugin (pre-1.2.0) contains an SQL injection due to unsafely used parameters in SQL statements. Impact is high for high-privilege users; exploitation could lead to sensitive DB access. Affected versions are prior to 1.2.0. Remediation: upgrade to 1.2.0+ (notably 1.2.1 ...

WordPress plugin Event Monster 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

WordPress Event Monster plugin <= 1.1.20 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability leading to Visitors Deletion discovered by Thura Moe Myint in the WordPress Event Monster plugin versions = 1.1.20. Solution Update the WordPress Event Management Tickets Booking plugin to the latest available version at least 1.2.0...

Event Monster < 1.2.1 - Admin+ SQLi

The plugin does not validate and escape some parameters before using them in SQL statements, which could lead to SQL Injection exploitable by high privilege users PoC...

WordPress Event Monster plugin <= 1.2.0 - Auth. SQL Injection (SQLi) vulnerability

Auth. SQL Injection SQLi vulnerability discovered by Thura Moe Myint in the WordPress Event Monster plugin versions = 1.2.0. Solution Update the WordPress Event Management Tickets Booking plugin to the latest available version at least 1.2.1...

Event Monster < 1.2.1 - Admin+ SQLi

The plugin does not validate and escape some parameters before using them in SQL statements, which could lead to SQL Injection exploitable by high privilege users...

Ransomware updates & 1-day exploits

Introduction In our crimeware reporting service, we analyze the latest crime-related trends we come across. Last month, we again posted a lot on ransomware, but we also covered other subjects, such as 1-day exploits. In this blogpost, we provide excerpts from these reports. For questions or more...

PyRDP - RDP Monster-In-The-Middle (Mitm) And Library For Python With The Ability To Watch Connections Live Or After The Fact

PyRDP is a Python Remote Desktop Protocol RDP Monster-in-the-Middle MITM tool and library. It features a few tools: RDP Monster-in-the-Middle Logs credentials used when connecting Steals data copied to the clipboard Saves a copy of the files transferred over the network Crawls shared drives in th...

[SECURITY] Fedora 31 Update: crawl-0.24.1-2.fc31

This is the Console ncurses version of crawl. Dungeon Crawl Stone Soup is a free roguelike game of exploration and treasure-hunting in dungeons filled with dangerous and unfriendly monsters in a quest for the mystifyingly fabulous Orb of Zot. Dungeon Crawl Stone Soup has diverse species and many...

WordPress Google Analytics by Monster Insights plugin <= 7.1.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability found by RIPS Technologies in WordPress Google Analytics by Monster Insights plugin versions = 7.1.0. Solution Update the WordPress Google Analytics by Monster Insights plugin to the latest available version at least 7.2.0...

Google Analytics by Monster Insights <= 7.1.0 - Authenticated Stored Cross-Site Scripting (XSS)

The Google Analytics Dashboard Plugin for WordPress by MonsterInsights WordPress plugin was affected by an Authenticated Stored Cross-Site Scripting XSS security vulnerability...

monster-hunter-x.gamerch.com XSS vulnerability

Open Bug Bounty ID: OBB-645805 Description| Value ---|--- Affected Website:| monster-hunter-x.gamerch.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

monster.com.my XSS vulnerability

Open Bug Bounty ID: OBB-608338 Description| Value ---|--- Affected Website:| monster.com.my Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

my.monsterindia.com XSS vulnerability

Open Bug Bounty ID: OBB-568248 Description| Value ---|--- Affected Website:| my.monsterindia.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...