daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Enhancement: cves/2022/CVE-2022-0212.yaml by md

patch-1
MostInterestingBotInTheWorld 2023-04-13 11:05:36 -04:00
parent 8978289427
commit 5776036ad8
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
cves/2022/CVE-2022-0212.yaml
View File

@ -1,11 +1,11 @@
id: CVE-2022-0212 id: CVE-2022-0212
info: info:
name: SpiderCalendar <= 1.5.65 - Unauthenticated Reflected Cross-Site Scripting name: WordPress Spider Calendar <=1.5.65 - Cross-Site Scripting
author: theamanrawat author: theamanrawat
severity: medium severity: medium
description: | description: |
The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue. WorsPress Spider Calendar plugin through 1.5.65 is susceptible to cross-site scripting. The plugin does not sanitize and escape the callback parameter before outputting it back in the page via the window AJAX action, available to both unauthenticated and authenticated users. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
reference: reference:
- https://wpscan.com/vulnerability/15be2d2b-baa3-4845-82cf-3c351c695b47 - https://wpscan.com/vulnerability/15be2d2b-baa3-4845-82cf-3c351c695b47
- https://wordpress.org/plugins/spider-event-calendar/ - https://wordpress.org/plugins/spider-event-calendar/
@ -41,3 +41,5 @@ requests:
- type: status - type: status
status: status:
- 200 - 200
# Enhanced by md on 2023/04/13