CVE-2020-36840: falha de alta gravidade em jetmonsters Timetable and Event Schedule by…
Timetable and Event Schedule by MotoPress <= 2.3.8 - Missing Authorization
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.3epss 0.4%
The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_route_url() function called via a nopriv AJAX action in versions up to, and including, 2.3.8. This makes it possible for unauthenticated attackers to call that function and perform a wide variety of actions such as including random template, injecting malicious web scripts, and more.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
jetmonsters · Timetable and Event Schedule by MotoPressCVEs relacionadas — jetmonsters Timetable and Event Schedule by…
No mesmo produto, das mais perigosas para as menos.
CVE-2024-3342CRITICALTimetable and Event Schedule by MotoPress <= 2.4.11 - Authenticated (Contributor+) SQL InjectionEPSS 0.6%CVE-2026-9228MEDIUMTimetable and Event Schedule by MotoPress <= 2.4.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via action_get_event_data FunctionEPSS 0.2%