Advisories · Technology
netweblogic Events Manager – Calendar, Bookings, Tickets, and more!.
Every CVE that names netweblogic Events Manager – Calendar, Bookings, Tickets, and more! among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.4 Medium
Events Manager - Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes
- netweblogic Events Manager – Calendar, Bookings, Tickets, and more!
- Cross-site scripting (XSS)
- CVSS 6.6 Medium
Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys
- netweblogic Events Manager – Calendar, Bookings, Tickets, and more!
- File inclusion
- CVSS 6.1 Medium
Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter
- netweblogic Events Manager – Calendar, Bookings, Tickets, and more!
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Events Manager <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' Parameters
- netweblogic Events Manager – Calendar, Bookings, Tickets, and more!
- Broken access control
- CVSS 6.5 Medium
Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action
- netweblogic Events Manager – Calendar, Bookings, Tickets, and more!
- SQL injection
- CVSS 6.4 Medium
Events Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode
- netweblogic Events Manager – Calendar, Bookings, Tickets, and more!
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Events Manager – Calendar, Bookings, Tickets, and more! <= 7.2.2.2 - Cross-Site Request Forgery to Location Deletion
- netweblogic Events Manager – Calendar, Bookings, Tickets, and more!
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
Events Manager <= 7.2.2.2 - Unauthenticated Information Exposure
- netweblogic Events Manager – Calendar, Bookings, Tickets, and more!
- Information disclosure
- CVSS 6.4 Medium
Events Manager <= 7.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes
- netweblogic Events Manager – Calendar, Bookings, Tickets, and more!
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Event Manager <= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` Parameter
- netweblogic Events Manager – Calendar, Bookings, Tickets, and more!
- Cross-site scripting (XSS)
- CVSS 7.5 HighCritical · CVSS 7+ and EPSS
Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter
- netweblogic Events Manager – Calendar, Bookings, Tickets, and more!
- SQL injection
- CVSS 7.5 High
Events Manager – Calendar, Bookings, Tickets, and more! <= 6.6.3 - Unauthenticated SQL Injection via Event Status Parameter
- netweblogic Events Manager – Calendar, Bookings, Tickets, and more!
- SQL injection
- CVSS 6.1 Medium
Events Manager <= 6.4.8 - Reflected Cross-Site Scripting
- netweblogic Events Manager – Calendar, Bookings, Tickets, and more!
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Events Manager – Calendar, Bookings, Tickets, and more! <= 6.4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via event, location, and event_category Shortcodes
- netweblogic Events Manager – Calendar, Bookings, Tickets, and more!
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Events Manager <= 6.4.7.1 - Cross-Site Request Forgery
- netweblogic Events Manager – Calendar, Bookings, Tickets, and more!
- Cross-site request forgery (CSRF)
- CVSS 6.4 Medium
Events Manager <= 6.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- netweblogic Events Manager – Calendar, Bookings, Tickets, and more!
- Cross-site scripting (XSS)
- CVSS 4.4 Medium
Events Manager <= 6.4.6.4 - Authenticated(Administator+) Stored Cross-Site Scripting via settings
- netweblogic Events Manager – Calendar, Bookings, Tickets, and more!
- Cross-site scripting (XSS)