CVE-2018-12621

CVE-2018-12621 affects Eventum 3.5.0 with an Open Redirect in /htdocs/switch.php via the current_page parameter. The issue enables redirection to arbitrary URLs. No explicit remediation or patch version is provided in the connected documents; details about exploit availability or mitigations are ...

CVE-2018-16761

CVE-2018-16761 affects Eventum before 3.4.0, which contains an open redirect vulnerability. The adjacent nuclei template confirms that an attacker can redirect a user to a malicious site, potentially enabling phishing or data exposure. Remediation per sources is to upgrade to Eventum version 3.4....

CVE-2014-1631

CVE-2014-1631 affects Eventum prior to 2.3.5. The root cause is incorrect default permissions in the installation workflow (setup/index.php) allowing remote reinstall, paired with potential code injection through /config/config.php during setup. Affected versions include Eventum 2.3.4 (and earlie...

CVE-2014-1632

CVE-2014-1632 : In Eventum, vulnerable up to version 2.3.4, the installation script/config handling allows remote code execution via the hostname parameter in /config/config.php during setup. The underlying issue is code injection due to insufficient input sanitization, enabling an attacker with ...

CVE-2018-11569

CVE-2018-11569 affects Eventum, specifically the PHP file list handling in 3.5.0 (Controller/ListController.php). The issue is described as a deserialization of untrusted data vulnerability, with a confirmed remediation in Eventum 3.5.2. Connected documents consistently identify the affected prod...

CVE-2018-12624

CVE-2018-12624 : An XSS vulnerability in Eventum 3.5.0 is reported in /htdocs/post_note.php via the garlic_prefix parameter. Several connected sources (NVD, Red Hat CVE entry, CNVD, OSV, CVE listings) corroborate that this is a cross-site scripting issue affecting Eventum 3.5.0 and related entrie...

CVE-2018-12627

Eventum 3.5.0 is affected by a cross-site scripting (XSS) vulnerability in /htdocs/list.php, exploitable via the show_notification_list_issues or show_authorized_issues parameters. The issue allows an attacker to inject client-side code, with impact described as typical XSS; exploitation details ...

CVE-2018-12625

CVE-2018-12625 affects Eventum 3.5.0, with an XSS vulnerability in /htdocs/validate.php via the values parameter. The connected sources corroborate a client-side data validation issue in Eventum 3.5.0; no further exploit details are provided in the provided documents. The NVD entry lists a CVSS v...

CVE-2018-12622

Eventum 3.5.0 is affected by an XSS in htdocs/ajax/update.php via the field_name parameter. The issue is reflected XSS with potential impact on confidentiality/integrity (per CVSSv3 6.1, MEDIUM). No exploit details or patch version are provided in the documents; a later release 3.5.2 is reference...

CVE-2018-12623

Eventum 3.5.0 is affected by a cross-site scripting (XSS) vulnerability in htdocs/switch.php via the current_page parameter. Public sources (NVD) describe the issue and assign CVE-2018-12623 with a CVSS v2 base score of 4.3 (medium) and CVSS v3 base score of 6.1 (medium); attack requires no user ...

CVE-2018-12626

Eventum 3.5.0 is affected by a cross-site scripting vulnerability in /htdocs/popup.php via the cat parameter. Impact is described as client-side code execution with partial integrity impact (per CVE notes). Connected advisories from Red Hat and CNVD/EUVD mirrors confirm the same issue exists in E...

CVE-2018-12628

Eventum 3.5.0 is affected by a CSRF vulnerability in htdocs/manage/users.php that allows an attacker to create another user with admin privileges. This CVE-2018-12628 entry documents the issue and its impact: unauthorized account creation with admin rights via CSRF, enabling partial/high impact c...