daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update CVE-2022-1054.yaml

patch-1
Prince Chaddha 2022-04-22 17:27:48 +04:00 committed by GitHub
parent b0f264c0b8
commit cc0a6213ca
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
cves/2022/CVE-2022-1054.yaml
View File

@ -4,7 +4,8 @@ info:
name: RSVP and Event Management < 2.7.8 - Unauthenticated Entries Export
author: Akincibor
severity: medium
description: The plugin does not have any authorisation checks when exporting its entries, and has the export function hooked to the init action. As a result, unauthenticated attackers could call it and retrieve PII such as first name, last name and email address of users registered for events.
description: |
The plugin does not have any authorisation checks when exporting its entries, and has the export function hooked to the init action. As a result, unauthenticated attackers could call it and retrieve PII such as first name, last name and email address of users registered for events.
reference:
- https://wpscan.com/vulnerability/95a5fad1-e823-4571-8640-19bf5436578d
tags: wp,wp-plugin,wordpress,cve,cve2022
@ -20,6 +21,8 @@ requests:
part: body
words:
- 'RSVP Status'
- '"First Name"'
condition: and
- type: status
status: