Cross site scripting

A vulnerability was found in MotoPress Timetable and Event Schedule. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /wp-admin/admin-ajax.php of the component Quick Edit. The manipulation of the argument posttitle with the input leads to cross si...

Cross site scripting

A vulnerability classified as problematic has been found in MotoPress Timetable and Event Schedule up to 1.4.06. This affects an unknown part of the file /wp/?cpmvcid=1&cpmvcdoaction=mvparse&f=datafeed&calid=1&monthindex=1&method=adddetails&id=2 of the component Calendar Handler. The manipulation...

CVE-2022-2844

CVE-2022-2844 affects MotoPress Timetable and Event Schedule up to 1.4.06. Affects the Calendar Handler component; manipulating Subject/Location/Description via the vulnerable endpoint (the file path in the Description) enables cross-site scripting. Exploitation is described as possible to initia...

CVE-2022-2844 MotoPress Timetable and Event Schedule Calendar cross site scripting

A vulnerability classified as problematic has been found in MotoPress Timetable and Event Schedule up to 1.4.06. This affects an unknown part of the file /wp/?cpmvcid=1&cpmvcdoaction=mvparse&f=datafeed&calid=1&monthindex=1&method=adddetails&id=2 of the component Calendar Handler. The manipulation...

CVE-2022-2843 MotoPress Timetable and Event Schedule Quick Edit admin-ajax.php cross site scripting

A vulnerability was found in MotoPress Timetable and Event Schedule. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /wp-admin/admin-ajax.php of the component Quick Edit. The manipulation of the argument posttitle with the input leads to cross si...

CVE-2022-2843

CVE-2022-2843 affects MotoPress Timetable and Event Schedule (WordPress plugin). The vulnerability exists in the Quick Edit path via /wp-admin/admin-ajax.php, where manipulating the post_title parameter with the payload triggers cross-site scripting. Exploitation may be remote. The issue is docu...

WordPress plugin MotoPress Timetable and Event Schedule 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

PT-2022-19030 · Motopress · Motopress Timetable/Event Schedule

Name of the Vulnerable Software and Affected Versions: MotoPress Timetable and Event Schedule versions up to 1.4.06 Description: A vulnerability has been found in the Calendar Handler component of MotoPress Timetable and Event Schedule. The issue affects an unknown part of the file "/wp/?cpmvc...

WordPress plugin MotoPress Timetable and Event Schedule 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

CVE-2022-2843: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in MotoPress Timetable and Event Schedule. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /wp-admin/admin-ajax.php of the component Quick Edit. The manipulation of the argument posttitle with the input leads to cross si...

CVE-2022-2844: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic has been found in MotoPress Timetable and Event Schedule up to 1.4.06. This affects an unknown part of the file /wp/?cpmvcid=1&cpmvcdoaction=mvparse&f=datafeed&calid=1&monthindex=1&method=adddetails&id=2 of the component Calendar Handler. The manipulation...

WordPress Simply Schedule Appointments plugin <= 1.5.7.6 - Unauthenticated Email Address Disclosure vulnerability

Unauthenticated Email Address Disclosure vulnerability discovered by Raad Haddad in WordPress Simply Schedule Appointments plugin versions = 1.5.7.6. Solution Update the WordPress Simply Schedule Appointments plugin to the latest available version at least 1.5.7.7...

WordPress Simply Schedule Appointments plugin <= 1.5.7.6 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability was discovered by Raad Haddad in the WordPress Simply Schedule Appointments plugin versions = 1.5.7.6. Solution Update the WordPress Simply Schedule Appointments plugin to the latest available version at least 1.5.7.7...

Simply Schedule Appointments < 1.5.7.7 - Unauthenticated Email Address Disclosure

The plugin is missing authorisation in a REST endpoint, allowing unauthenticated users to retrieve WordPress users details such as name and email address https://example.com/wp-json/ssa/v1/users...

Simply Schedule Appointments < 1.5.7.7 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Navigate to style settings:...

Simply Schedule Appointments < 1.5.7.7 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC Navigate to style settings:...

PT-2022-18198 · Unknown · Sourcecodester Online Class/Exam Scheduling System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Class and Exam Scheduling System version 1.0 Description: A critical vulnerability has been found in the SourceCodester Online Class and Exam Scheduling System. The issue is related to an unknown function of the file...

Samsung Calendar Information Disclosure Vulnerability (CNVD-2022-76488)

Samsung Calendar, a calendar module for Samsung mobile devices, is vulnerable to information disclosure in versions prior to Samsung Calendar 12.3.05.10000. The vulnerability stems from a lack of protection for information in the calendar, which can be exploited to gain access to the calendar...

CVE-2022-33705

Information exposure in Calendar prior to version 12.3.05.10000 allows attacker to access calendar schedule without READCALENDAR permission...

SAMSUNG Calendar 安全漏洞

Samsung Calendar, a calendar module for Samsung mobile devices, is vulnerable to information disclosure in versions prior to Samsung Calendar 12.3.05.10000. The vulnerability stems from a lack of protection for information in the calendar, which can be exploited to gain access to the calendar...