167 matches found
CVE-2024-9575 Local File Inclusion in pretix-widget WordPress plugin
Local File Inclusion vulnerability in pretix Widget WordPress plugin pretix-widget on Windows allows PHP Local File Inclusion. This issue affects pretix Widget WordPress plugin: from 1.0.0 through 1.0.5...
CVE-2024-9575 Local File Inclusion in pretix-widget WordPress plugin
Local File Inclusion vulnerability in pretix Widget WordPress plugin pretix-widget on Windows allows PHP Local File Inclusion. This issue affects pretix Widget WordPress plugin: from 1.0.0 through 1.0.5...
CVE-2024-9575
CVE-2024-9575 : Local File Inclusion in the WordPress plugin pretix-widget (Windows) affects versions 1.0.0–1.0.5. The vulnerability stems from a local file inclusion flaw in the plugin’s handling of input, enabling potential exposure of local files. A fix is available in version 1.0.6 (Patchstac...
WordPress plugin pretix Widget 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
WordPress pretix widget Plugin <= 1.0.5 is vulnerable to Local File Inclusion
Software pretix widget Type Plugin Vulnerable versions = 1.0.5 Fixed in 1.0.6 OWASP Top 10 A4: Insecure Design Classification Local File Inclusion CVE CVE-2024-9575 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 3a2933f81cf6 Credits João Pedro S Alcântara Kinorth Required...
Cross-site Scripting (XSS)
pretix is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper user input sanitization in the placeholders like name or event. An attacker can inject HTML tags into email previews on the settings page by exploiting this vulnerability...
pretix Stored Cross-site Scripting vulnerability
Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page. The default Content Security Policy of pretix prevents execution of attacker-provided scripts, making exploitation unlikely. However,...
GHSA-45RP-Q25W-4426 pretix Stored Cross-site Scripting vulnerability
Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page. The default Content Security Policy of pretix prevents execution of attacker-provided scripts, making exploitation unlikely. However,...
CVE-2024-8113
Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page. The default Content Security Policy of pretix prevents execution of attacker-provided scripts, making exploitation unlikely. However,...
PYSEC-2024-180
Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page. The default Content Security Policy of pretix prevents execution of attacker-provided scripts, making exploitation unlikely. However,...
PYSEC-2024-180
Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page. The default Content Security Policy of pretix prevents execution of attacker-provided scripts, making exploitation unlikely. However,...
CVE-2024-8113 Stored XSS in Placeholder Samples in Mail Preview
Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page. The default Content Security Policy of pretix prevents execution of attacker-provided scripts, making exploitation unlikely. However,...
CVE-2024-8113 Stored XSS in Placeholder Samples in Mail Preview
Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page. The default Content Security Policy of pretix prevents execution of attacker-provided scripts, making exploitation unlikely. However,...
CVE-2024-8113 Stored XSS in Placeholder Samples in Mail Preview
Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page. The default Content Security Policy of pretix prevents execution of attacker-provided scripts, making exploitation unlikely. However,...
CVE-2024-8113
CVE-2024-8113 affects pretix up to version 2024.7.0, where stored XSS exists in organizer/event settings and can affect email previews on the settings page. The default CSP mitigates script execution, reducing exploitability, and exploitation would require a CSP bypass (not currently known). The ...
PT-2024-38809 · Pretix · Pretix
Name of the Vulnerable Software and Affected Versions: pretix versions up to 2024.7.0 Description: The issue allows malicious event organizers to inject HTML tags into e-mail previews on the settings page. The default Content Security Policy of pretix prevents execution of attacker-provided...
rami.io pretix 安全漏洞
rami.io pretix is a ticket store application for conferences, festivals, concerts, tech events, shows, exhibitions, workshops, bars, etc. from the German company rami.io. A security vulnerability exists in rami.io pretix version 2024.7.0 and earlier versions. An attacker can exploit the...
Improper Input Validation
pretix is vulnerable to Improper Input Validation. The vulnerability is due to improper validation of files uploaded by users, which could allow attackers to upload malicious files and execute arbitrary code...