CVE-2021-24584

MEDIUM Year: 2021
CVSS v3 Score
5.4
Medium
CVSS v2 Score
3.5
Low
Weakness Type
CWE-79
View all →

Vulnerability Description

The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any user with the edit_posts capability (contributor+) to update arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be perform via CSRF against a logged in with such capability. In versions before 2.3.19, the lack of sanitisation and escaping in some of the fields, like the descritption could also lead to Stored XSS issues

Related Vulnerabilities

CVE-2006-10001

MEDIUM
CVSS:5.4(Medium)

A vulnerability, which was classified as problematic, was found in Subscribe to Comments Plugin up to 2.0.7 on WordPress. This affects an unknown part of the file subscribe-to-comments.php. The manipu...

CWE-792006

CVE-2007-1679

MEDIUM
CVSS:5.4(Medium)

Multiple cross-site scripting (XSS) vulnerabilities in Horde Groupware Webmail 1.0 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors in (1) imp/search.php...

CWE-792007

CVE-2010-10008

MEDIUM
CVSS:5.4(Medium)

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in simplesamlphp simplesamlphp-module-openidprovider up to 0.8.x. It has been declared as problematic. Affected by this vulnerability is an un...

CWE-792010

CVE-2010-3659

MEDIUM
CVSS:5.4(Medium)

Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 CMS 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 allow remote authenticated backend users to inject...

CWE-792010

CVE-2010-3660

MEDIUM
CVSS:5.4(Medium)

TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS on the backend.

CWE-792010

CVE-2010-3665

MEDIUM
CVSS:5.4(Medium)

TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS on the Extension Manager.

CWE-792010