437 matches found
Cross site request forgery (csrf)
The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.3. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to delete, and modify calendars as well as the...
CVE-2022-3852
The VR Calendar plugin for WordPress (versions up to 2.3.3) is vulnerable to Cross-Site Request Forgery due to missing/incorrect nonce validation on several functions. This enables unauthenticated attackers to delete or modify calendars and plugin settings by inducing an admin to perform forged a...
CVE-2022-3852 VR Calendar <= 2.3.3 - Cross-Site Request Forgery
The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.3. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to delete, and modify calendars as well as the...
CVE-2022-3852 VR Calendar <= 2.3.3 - Cross-Site Request Forgery
The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.3. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to delete, and modify calendars as well as the...
VR Calendar < 2.3.4 - Calendar Deletion/Update & Settings Update via CSRF
The plugin does not have CSRF checks when deleting and updating calendars, as well as updating the plugin settings, which could allow attackers to make logged a admin delete and update arbitrary calendars and modify the plugin settings via CSRF attacks...
PT-2022-24435 · WordPress · Vr Calendar
Name of the Vulnerable Software and Affected Versions: VR Calendar plugin for WordPress versions up to, and including, 2.3.3 Description: The issue is due to missing or incorrect nonce validation on several functions, making it possible for unauthenticated attackers to delete and modify calendars...
WordPress plugin VR Calendar 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...
WordPress VR Calendar plugin <= 2.3.3 – Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability leading to deletion and modification of calendars as well as the plugin settings discovered by Marco Wotschka in the WordPress VR Calendar plugin versions = 2.3.3. Solution Update the WordPress VR Calendar plugin to the latest available version at lea...
CVE-2022-2314
The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site...
CVE-2022-2314
The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site...
CVE-2022-2314
The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site...
Design/Logic Flaw
The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site...
CVE-2022-2314 VR Calendar < 2.3.2 - Unauthenticated Arbitrary Function Call
The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site...
CVE-2022-2314
The CVE-2022-2314 case concerns the WordPress VR Calendar plugin (versions up to and including 2.3.2). Affected component: VR Calendar WordPress plugin; root cause: unauthenticated arbitrary PHP function calls, enabling remote code execution. Impact stated across sources: attacker can execute arb...
PT-2022-15878 · WordPress · Vr Calendar
Name of the Vulnerable Software and Affected Versions: VR Calendar WordPress plugin versions prior to 2.3.3 Description: The issue allows any user to execute arbitrary PHP functions on the site. This can lead to unauthorized access and potential code execution. Recommendations: For versions prior...
VR Calendar <= 2.3.4 - Admin+ LFI
The plugin does not validate user input before using it in a require statement, which could allow high privilege users to perform LFI attacks. The attack could also be performed via a CSRF vector by making a logged in admin open a malicious link PoC...
VR Calendar < 2.3.1 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting PoC https://example.com/wp-admin/plugins.php?vrcmsg=msgtype="...
VR Calendar <= 2.3.4 - Admin+ LFI
The plugin does not validate user input before using it in a require statement, which could allow high privilege users to perform LFI attacks. The attack could also be performed via a CSRF vector by making a logged in admin open a malicious link...
VR Calendar < 2.3.2 - Unauthenticated Arbitrary Function Call
The plugin lets any user execute arbitrary PHP functions on the site. PoC https://example.com/wp-admin/admin-post.php?vrccmd=phpinfo...
VR Calendar < 2.3.2 - Unauthenticated Arbitrary Function Call
The plugin lets any user execute arbitrary PHP functions on the site. https://example.com/wp-admin/admin-post.php?vrccmd=phpinfo...