CVE-2024-6033: falha de média gravidade em arraytics Eventin – Event Calendar, Event…
Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Event Data Import
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.4%
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized data importation due to a missing capability check on the 'import_file' function in all versions up to, and including, 4.0.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to import events, speakers, schedules and attendee data.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
arraytics · Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)CVEs relacionadas — arraytics Eventin – Event Calendar, Event…
No mesmo produto, das mais perigosas para as menos.
CVE-2024-7149HIGHEvent Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.8 - Authenticated (Contributor+) Local File InclusionEPSS 1.0%CVE-2025-1770HIGHEvent Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Authenticated (Contributor+) Local File InclusionEPSS 0.9%CVE-2025-3419HIGHEvent Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.26 - Unauthenticated Arbitrary File ReadEPSS 0.7%CVE-2025-4796HIGHEventin <= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account TakeoverEPSS 0.7%CVE-2024-1122MEDIUMEvent Manager, Events Calendar, Events Tickets for WooCommerce – Eventin <= 3.3.50 - Missing Authorization to Unauthenticated Events ExportEPSS 0.5%CVE-2025-1766MEDIUMEvent Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status UpdateEPSS 0.4%