WordPress Plugin Vulnerabilities

All-in-One Event Calendar 1.9 - index.php Multiple Parameter SQL Injection

Description

The All-in-One Event Calendar WordPress plugin was affected by an index.php Multiple Parameter SQL Injection security vulnerability.

Affects Plugins

Plugin icon
all-in-one-event-calendar
Fixed in 1.10

References

URL
https://firefart.at/post/sql-injection-and-xss-in-all-in-one-event-calendar-wordpress-plugin/

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89

Miscellaneous

Verified
No
WPVDB ID
aeacdda5-6039-4ce7-8b5a-f58a740cf4d1

Timeline

Publicly Published
2014-08-01 (about 9 years ago)
Added
2014-08-01 (about 9 years ago)
Last Updated
2019-10-21 (about 4 years ago)

Other

Published
Title
Published
2014-08-01
Title
Event Registration 5.32 - SQL Injection
Published
2024-03-28
Title
WP Responsive Tabs horizontal vertical and accordion Tabs < 1.1.18 - Authenticated (Contributor+) SQL Injection
Published
2023-09-18
Title
wpDiscuz < 7.6.6 - Unauthenticated SQL Injection
Published
2023-10-30
Title
Message ticker < 9.3 - Authenticated (Subscriber+) SQL Injection via Shortcode
Published
2014-08-01
Title
p1m media manager - SQL Injection