Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

14 records

Vendor: davidfcarr Component: Rsvpmaker Clear all filters
TI-2024-33960 CVE-2024-50531 · GHSA-fqg9-xpjx-879w

WordPress RSVPMaker for Toastmasters plugin <= 6.2.4 - Arbitrary File Upload vulnerability

Priority MEDIUM 49

Unrestricted Upload of File with Dangerous Type vulnerability in davidfcarr RSVPMaker for Toastmasters rsvpmaker-for-toastmasters allows Upload a Web Shell to a Web Server.This issue affects RSVPMaker for Toastmasters: f…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00511 Published 2024-11-04 No fix listed CWE-434
TI-2022-01634 CVE-2022-1768 · GHSA-q33g-8g5w-2m7c

RSVPMaker <= 9.3.2 - Unauthenticated SQL Injection

Priority MEDIUM 63

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user supplied data passed to multiple SQL queries in the ~/rsvpmaker-email.php file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.1286 Published 2022-06-13 No fix listed CWE-89
TI-2022-01378 CVE-2022-1505 · GHSA-6h3g-g32r-8ff5

RSVPMaker <= 9.2.6 - Unauthenticated SQL Injection

Priority MEDIUM 53

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-api-endpoints.php file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01904 Published 2022-05-10 No fix listed CWE-89
TI-2022-01328 CVE-2022-1453 · GHSA-r8cv-3fj5-m22g

RSVPMaker <= 9.2.5 - Unauthenticated SQL Injection

Priority MEDIUM 59

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06922 Published 2022-05-10 No fix listed CWE-89
TI-2021-06663 CVE-2021-24371 · GHSA-hjpv-ppp8-7v6j

RSVPMaker < 8.7.3 - Authenticated (admin+) SSRF

Priority LOW 16

The Import feature of the RSVPMaker WordPress plugin before 8.7.3 (/wp-admin/tools.php?page=rsvpmaker_export_screen) takes an URL input and calls curl on it, without first validating it to ensure it's a remote one.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.01012 Published 2021-08-02 Fixed in 8.7.3 CWE-918