CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-5860 – Tickera <= 3.5.2.8 - Missing Authorization to Authenticated (Susbcriber+) Ticket Deletion
https://notcve.org/view.php?id=CVE-2024-5860
17 Jun 2024 — The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the tc_dl_delete_tickets AJAX action in all versions up to, and including, 3.5.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all tickets associated with events. El complemento Tickera – WordPress Event Ticketing para WordPress es vulnerable a la pérdida no autorizada de datos debido a una falta de verificació... • https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3103413%40tickera-event-ticketing-system&new=3103413%40tickera-event-ticketing-system&sfp_email=&sfph_mail= • CWE-862: Missing Authorization CWE-863: Incorrect Authorization •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-35729 – WordPress Tickera – WordPress Event Ticketing plugin <= 3.5.2.6 - Broken Access Control vulnerability
https://notcve.org/view.php?id=CVE-2024-35729
06 Jun 2024 — Missing Authorization vulnerability in Tickera.This issue affects Tickera: from n/a through 3.5.2.6. Vulnerabilidad de autorización faltante en Tickera. Este problema afecta a Tickera: desde n/a hasta 3.5.2.6. The Tickera plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the generate_ticket_preview() function in versions up to, and including, 3.5.2.6. This makes it possible for authenticated attackers, with contributor-level access and above, to generate ... • https://patchstack.com/database/vulnerability/tickera-event-ticketing-system/wordpress-tickera-wordpress-event-ticketing-plugin-3-5-2-6-broken-access-control-vulnerability?_s_id=cve • CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-7252 – Tickera < 3.5.2.5 - Ticket leakage through IDOR
https://notcve.org/view.php?id=CVE-2023-7252
01 Apr 2024 — The Tickera WordPress plugin before 3.5.2.5 does not prevent users from leaking other users' tickets. El complemento Tickera WordPress anterior a 3.5.2.5 no impide que los usuarios filtren los tickets de otros usuarios. The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.5.2.4 via the order_key parameter due to missing validation on the user controlled key. This makes it possible for unauthenticated attackers ... • https://wpscan.com/vulnerability/c452c5da-05a6-4a14-994d-e5049996d496 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 1CVE-2022-4549 – Tickera < 3.5.1.0 - Plugin Data Deletion via CSRF
https://notcve.org/view.php?id=CVE-2022-4549
23 Dec 2022 — The Tickera WordPress plugin before 3.5.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. El complemento Tickera de WordPress anterior a 3.5.1.0 no tiene activada la verificación CSRF al actualizar sus configuraciones, lo que podría permitir a los atacantes hacer que un administrador que haya iniciado sesión las cambie mediante un ataque CSRF. The Tickera plugin for WordPress is vulnerable to Cross-Site Requ... • https://wpscan.com/vulnerability/06e1be38-fc1a-4799-a006-556b678ae701 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24797 – Tickera < 3.4.8.3 - Unauthenticated Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-24797
23 Nov 2021 — The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins. El plugin Tickera de WordPress versiones anteriores a 3.4.8.3, no sanea ni escapa de los campos Name de los Eventos reservados antes de mostrarlos en el panel de administración de Pedidos, lo que podría permitir a usuarios no autenticados llevar a... • https://wpscan.com/vulnerability/0eb07cc8-8a19-4e01-ab90-844495413453 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •