CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6360 – My Calendar <= 3.4.21 - Unauthenticated SQL Injection
https://notcve.org/view.php?id=CVE-2023-6360
The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' parameters in the '/my-calendar/v1/events' rest route. El complemento 'My Calendar' de WordPress, versión <3.4.22, se ve afectado por una vulnerabilidad de inyección SQL no autenticada en los parámetros 'desde' y 'hasta' en la ruta de descanso '/my-calendar/v1/events'. The My Calendar plugin for WordPress is vulnerable to [blind|generic|time-based] SQL Injection via the 'from' and 'to' parameters of the '/my-calendar/v1/events' rest route in all versions up to, and including, 3.4.21 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. • https://www.tenable.com/security/research/tra-2023-40 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 53EXPL: 1CVE-2012-6527 – My Calendar < 1.10.5 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-6527
Cross-site scripting (XSS) vulnerability in the My Calendar plugin before 1.10.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. Cross-site scripting (XSS) en el plug-in My Calendar antes de v1.10.2 para WordPress permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del PATH_INFO. Cross-site scripting (XSS) vulnerability in the My Calendar plugin before 1.10.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. • http://plugins.trac.wordpress.org/changeset/490070/my-calendar http://secunia.com/advisories/47579 http://wordpress.org/extend/plugins/my-calendar/changelog http://www.securityfocus.com/bid/51539 https://exchange.xforce.ibmcloud.com/vulnerabilities/72454 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •