CVE-2024-6910mediumCWE-79

CVE-2024-6910: falha de média gravidade em EventON

EventON < 2.2.17 - Admin+ Stored XSS

Publicada em

Seguir esta CVE+ Monitorar EventON

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.8epss 0.4%
The EventON WordPress plugin before 2.2.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
Unknown · EventON
CVEs relacionadas — EventON

No mesmo produto, das mais perigosas para as menos.

CVE-2023-2796—EventON < 2.1.2 - Unauthenticated Event AccessEPSS 42.7%CVE-2024-0235MEDIUMEventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Email Address DisclosureEPSS 38.0%CVE-2023-3219—EventON < 2.1.2 - Unauthenticated Post Access via IDOREPSS 7.5%CVE-2023-4388MEDIUMEventON < 2.2 - Admin+ Stored XSSEPSS 0.5%CVE-2024-0236MEDIUMEventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Virtual Event Password DisclosureEPSS 0.5%CVE-2023-6005MEDIUMEventON (Free < 2.2.7, Premium < 4.5.5) - Admin+ Stored Cross-Site ScriptingEPSS 0.4%