Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
2 selected

3 records

Vendor: Tiempo Component: Tiempo Clear all filters
TI-2023-02131 CVE-2023-2272 · GHSA-px5c-85f9-xr32

Tiempo.com <= 0.1.2 - Reflected XSS

Priority MEDIUM 60

The Tiempo.com WordPress plugin through 0.1.2 does not sanitise and escape the page parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0085 Published 2023-08-16 No fix listed
TI-2023-00054 CVE-2023-0058 · GHSA-m256-5rj4-75c4

Tiempo.com <= 0.1.2 - Stored XSS via CSRF

Priority LOW 27

The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when creating and editing its shortcode, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Sto…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00237 Published 2023-08-16 No fix listed
TI-2023-02130 CVE-2023-2271 · GHSA-g78h-3x72-cmgm

Tiempo.com <= 0.1.2 - Shortcode Deletion via CSRF

Priority MEDIUM 53

The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when deleting its shortcode, which could allow attackers to make logged in admins delete arbitrary shortcode via a CSRF attack

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00252 Published 2023-08-16 No fix listed