admin/cve
1
0
Fork 0
mirror of https://github.com/0xMarcio/cve.git synced 2025-05-06 02:31:38 +00:00
Code Issues Packages Projects Releases Wiki Activity
cve/2023/CVE-2023-2414.md
0xMarcio 8d17e0c8f8 Update CVE sources 2024-08-24 17:55
2024-08-24 17:55:21 +00:00

1.1 KiB
Raw Permalink Blame History

CVE-2023-2414

Description

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_save_settings_callback function in versions up to, and including, 4.4.6. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to modify the plugins settings, upload arbitrary files, and inject malicious JavaScript (before 4.3.2).

POC

Reference

Github

No PoCs found on GitHub currently.