Filtered by vendor Tri
Subscribe
Total
9 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-6557 | 1 Tri | 1 The Events Calendar | 2024-02-12 | N/A | 5.3 MEDIUM |
| The The Events Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.2.8.2 via the route function hooked into wp_ajax_nopriv_tribe_dropdown. This makes it possible for unauthenticated attackers to extract potentially sensitive data including post titles and IDs of pending, private and draft posts. | |||||
| CVE-2023-6203 | 1 Tri | 1 The Events Calendar | 2023-12-21 | N/A | 7.5 HIGH |
| The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted request | |||||
| CVE-2023-0381 | 1 Tri | 1 Gigpress | 2023-12-10 | N/A | 8.8 HIGH |
| The GigPress WordPress plugin through 2.3.28 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks | |||||
| CVE-2020-36626 | 1 Tri | 1 Panel Builder | 2023-12-10 | N/A | 6.1 MEDIUM |
| A vulnerability classified as critical has been found in Modern Tribe Panel Builder Plugin. Affected is the function add_post_content_filtered_to_search_sql of the file ModularContent/SearchFilter.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 4528d4f855dbbf24e9fc12a162fda84ce3bedc2f. It is recommended to apply a patch to fix this issue. VDB-216738 is the identifier assigned to this vulnerability. | |||||
| CVE-2021-25028 | 1 Tri | 1 Event Tickets | 2023-12-10 | 5.8 MEDIUM | 6.1 MEDIUM |
| The Event Tickets WordPress plugin before 5.2.2 does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the given value, leading to an arbitrary redirect issue | |||||
| CVE-2019-15109 | 1 Tri | 1 The Events Calendar | 2023-12-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter. | |||||
| CVE-2019-16120 | 1 Tri | 1 Event Tickets | 2023-12-10 | 6.5 MEDIUM | 8.8 HIGH |
| CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post> Ticketed > Attendees" Export Attendees feature. | |||||
| CVE-2015-9353 | 1 Tri | 1 Gigpress | 2023-12-10 | 6.5 MEDIUM | 7.2 HIGH |
| The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066. | |||||
| CVE-2015-4066 | 1 Tri | 1 Gigpress | 2023-12-10 | 6.5 MEDIUM | N/A |
| Multiple SQL injection vulnerabilities in admin/handlers.php in the GigPress plugin before 2.3.9 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) show_artist_id or (2) show_venue_id parameter in an add action in the gigpress.php page to wp-admin/admin.php. | |||||