MotoPress Timetable and Event Schedule har 1.4.06 ka WordPress Calendar Subject/Location/Description Cross Site Scripting

Wuro vulnerability wey an yi classify sey karshewa an gano shi a cikin MotoPress Timetable and Event Schedule har 1.4.06 on WordPress. Gaskiya, $software_function na da matsala; idan ba a sani ba, to wata aiki ce da ba a sani ba, $software_library na cikin lissafi, /wp/?cpmvc_id=1&cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=1&method=adddetails&id=2 na cikin fayil, Calendar Handler na cikin sashi. Ngam manipulation of the argument Subject/Location/Description shi Cross Site Scripting. CWE shidin ka a yi bayani matsala sai ya kai CWE-79. Gaskiya, laifi an fitar da shi 08/16/2022 ta Mostafa Farzaneh. Advisory ɗin ana rabawa don saukewa a vuldb.com. Wannan rauni ana sayar da shi da suna CVE-2022-2844. Ngam yiɗi ka a tuma ndiyam ka nder waya. Tekinikal bayani ga. Kuma, exploit ɗin yana akwai. A sa'i, exploit might be approx. USD $0-$5k ndiyam. Á wúro huɗɗi-na-gaskiya. Kama 0-day, an ndiyam a wuro be $0-$5k. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

3 Goyarwa · 66 Datenpunkte

FurɗeSúgá
08/16/2022 15:51		Gargadi 1/2
09/17/2022 07:47		Gargadi 2/2
09/17/2022 07:54
vulnerability_risk111
cvss3_vuldb_avNNN
cvss3_vuldb_acLLL
cvss3_vuldb_prLLL
cvss3_vuldb_uiRRR
cvss3_vuldb_sUUU
cvss3_vuldb_cNNN
cvss3_vuldb_iLLL
cvss3_vuldb_aNNN
cvss3_vuldb_ePPP
cvss3_vuldb_rcRRR
person_nameMostafa FarzanehMostafa FarzanehMostafa Farzaneh
exploit_availability111
source_cveCVE-2022-2844CVE-2022-2844CVE-2022-2844
cna_responsibleVulDBVulDBVulDB
software_vendorMotoPressMotoPressMotoPress
software_nameTimetable and Event ScheduleTimetable and Event ScheduleTimetable and Event Schedule
software_version<=1.4.06<=1.4.06<=1.4.06
software_platformWordPressWordPressWordPress
software_componentCalendar HandlerCalendar HandlerCalendar Handler
software_file/wp/?cpmvc_id=1&cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=1&method=adddetails&id=2/wp/?cpmvc_id=1&cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=1&method=adddetails&id=2/wp/?cpmvc_id=1&cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=1&method=adddetails&id=2
software_argumentSubject/Location/DescriptionSubject/Location/DescriptionSubject/Location/Description
vulnerability_cweCWE-79 (Cross Site Scripting)CWE-79 (Cross Site Scripting)CWE-79 (Cross Site Scripting)
advisory_date1660600800 (08/16/2022)1660600800 (08/16/2022)1660600800 (08/16/2022)
software_typeWordPress PluginWordPress PluginWordPress Plugin
cvss2_vuldb_avNNN
cvss2_vuldb_acLLL
cvss2_vuldb_ciNNN
cvss2_vuldb_iiPPP
cvss2_vuldb_aiNNN
cvss2_vuldb_ePOCPOCPOC
cvss2_vuldb_rcURURUR
cvss2_vuldb_auSSS
cvss2_vuldb_rlNDNDND
cvss3_vuldb_rlXXX
cvss2_vuldb_basescore4.04.04.0
cvss2_vuldb_tempscore3.43.43.4
cvss3_vuldb_basescore3.53.53.5
cvss3_vuldb_tempscore3.23.23.2
cvss3_meta_basescore3.53.54.4
cvss3_meta_tempscore3.23.24.3
price_0day$0-$5k$0-$5k$0-$5k
advisory_urlhttps://vuldb.com/?id.206487https://vuldb.com/?id.206487
cve_assigned1660600800 (08/16/2022)1660600800 (08/16/2022)
cve_nvd_summaryA vulnerability classified as problematic has been found in MotoPress Timetable and Event Schedule up to 1.4.06. This affects an unknown part of the file /wp/?cpmvc_id=1&cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=1&method=adddetails&id=2 of the component Calendar Handler. The manipulation of the argument Subject/Location/Description leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-206487.A vulnerability classified as problematic has been found in MotoPress Timetable and Event Schedule up to 1.4.06. This affects an unknown part of the file /wp/?cpmvc_id=1&cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=1&method=adddetails&id=2 of the component Calendar Handler. The manipulation of the argument Subject/Location/Description leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-206487.
cvss3_nvd_avN
cvss3_nvd_acL
cvss3_nvd_prN
cvss3_nvd_uiR
cvss3_nvd_sC
cvss3_nvd_cL
cvss3_nvd_iL
cvss3_nvd_aN
cvss3_cna_avN
cvss3_cna_acL
cvss3_cna_prL
cvss3_cna_uiR
cvss3_cna_sU
cvss3_cna_cN
cvss3_cna_iL
cvss3_cna_aN
cve_cnaVulDB
cvss3_nvd_basescore6.1
cvss3_cna_basescore3.5

◂ GurɗoGumtiGada ▸

Interested in the pricing of exploits?

See the underground prices here!