Описание
The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability.
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.4.8 (исключая)
cpe:2.3:a:mobileeventsmanager:mobile_events_manager:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 78%
0.01134
Низкий
8.8 High
CVSS3
Дефекты
CWE-1236
Связанные уязвимости
CVSS3: 8.8
github
больше 3 лет назад
The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability.
EPSS
Процентиль: 78%
0.01134
Низкий
8.8 High
CVSS3
Дефекты
CWE-1236