CVE-2025-3419highCWE-73

CVE-2025-3419: fallo de gravedad alta en arraytics Eventin – Event Calendar, Event…

Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.26 - Unauthenticated Arbitrary File Read

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Eventin – Event Calendar, Event Registration, Tickets & Booking

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 0.7%
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 4.0.26 via the proxy_image() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. CVE-2025-47445 is a duplicate of this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
arraytics · Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)
CVEs relacionadas — arraytics Eventin – Event Calendar, Event…

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-7149HIGHEvent Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.8 - Authenticated (Contributor+) Local File InclusionEPSS 1.0%CVE-2025-1770HIGHEvent Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Authenticated (Contributor+) Local File InclusionEPSS 0.9%CVE-2025-4796HIGHEventin <= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account TakeoverEPSS 0.7%CVE-2024-1122MEDIUMEvent Manager, Events Calendar, Events Tickets for WooCommerce – Eventin <= 3.3.50 - Missing Authorization to Unauthenticated Events ExportEPSS 0.5%CVE-2025-1766MEDIUMEvent Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status UpdateEPSS 0.4%CVE-2024-6033MEDIUMEvent Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Event Data ImportEPSS 0.4%