CVE-2023-7252

The Tickera WordPress plugin before 3.5.2.5 does not prevent users from leaking other users' tickets...

CVE-2023-7252 Tickera < 3.5.2.5 - Ticket leakage through IDOR

The Tickera WordPress plugin before 3.5.2.5 does not prevent users from leaking other users' tickets...

CVE-2023-7252 Tickera < 3.5.2.5 - Ticket leakage through IDOR

The Tickera WordPress plugin before 3.5.2.5 does not prevent users from leaking other users' tickets...

CVE-2023-7252

CVE-2023-7252 affects the Tickera WordPress Event Ticketing plugin (before 3.5.2.5). Multiple sources confirm an Insecure Direct Object Reference (IDOR) condition that permits leakage of other users’ tickets due to insufficient access controls. The issue is tracked in public CVE records with the ...

PT-2024-15252 · WordPress · Tickera

Name of the Vulnerable Software and Affected Versions: The Tickera WordPress plugin versions prior to 3.5.2.5 Description: The issue allows users to leak other users' tickets due to a lack of proper prevention mechanisms. Recommendations: For versions prior to 3.5.2.5, update to version 3.5.2.5 o...

WordPress Tickera Plugin < 3.5.2.5 is vulnerable to Insecure Direct Object References (IDOR)

Software Tickera Type Plugin Vulnerable versions 3.5.2.5 Fixed in 3.5.2.5 OWASP Top 10 A4: Insecure Design Classification Insecure Direct Object References IDOR CVE CVE-2023-7252 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 18b5f01f3b4e Credits Martin Thirup Christensen...

WordPress plugin Tickera 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

Tickera < 3.5.2.5 - Ticket leakage through IDOR

Description The plugin does not prevent users from leaking other users' tickets. After a user has bought a ticket, an example of a ticket would look like https://www.website.com/?downloadticket=1&orderkey=1234567890&downloadticketnonce=ab903b7c71, but due to missing validation, the URL can be...

Tickera < 3.5.2.5 - Ticket leakage through IDOR

Description The plugin does not prevent users from leaking other users' tickets. PoC After a user has bought a ticket, an example of a ticket would look like https://www.website.com/?downloadticket=1key=1234567890ticketnonce=ab903b7c71, but due to missing validation, the URL can be shortened to...

WordPress Tickera Plugin < 3.4.8.4 is vulnerable to Cross Site Scripting (XSS)

Software Tickera Type Plugin Vulnerable versions 3.4.8.4 Fixed in 3.4.8.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 572bf731f4a5 Credits Rafie Muhammad Patchstack Required...

WordPress Tickera Plugin <= 3.5.1.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Tickera Type Plugin Vulnerable versions = 3.5.1.0 Fixed in 3.5.1.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-23726 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 674b722356ed Credits István Márton Required...

CVE-2022-4549

The Tickera WordPress plugin before 3.5.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack...

CVE-2022-4549

The Tickera WordPress plugin before 3.5.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack...

Cross site request forgery (csrf)

The Tickera WordPress plugin before 3.5.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack...

CVE-2022-4549 Tickera < 3.5.1.0 - Plugin Data Deletion via CSRF

The Tickera WordPress plugin before 3.5.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack...

CVE-2022-4549

CVE-2022-4549 affects the Tickera WordPress plugin for versions prior to 3.5.1.0. The root cause is a missing CSRF check when updating settings, allowing a logged-in administrator to potentially change settings via CSRF. Several connected sources corroborate this vulnerability and describe the af...

CVE-2022-4549 Tickera < 3.5.1.0 - Plugin Data Deletion via CSRF

The Tickera WordPress plugin before 3.5.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack...

PT-2023-14680 · WordPress · Tickera

Name of the Vulnerable Software and Affected Versions: Tickera WordPress plugin versions prior to 3.5.1.0 Description: The issue concerns a lack of CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. This could potentially lead t...

WordPress plugin Tickera 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

Tickera < 3.5.1.0- Plugin Data Deletion via CSRF

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. PoC 1. Navigate to Tickera Settings » Delete info 2. Delete info request intercept like that POST...