CVE-2021-24797

MEDIUM

Tickera < 3.4.8.3 - Unauthenticated Stored Cross-Site Scripting

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-24797 has a selected CVSS score of 6.1 (medium); EIP currently links 2 curated repository PoCs.

Description

The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.

Description source: CVE List

Exploitation context

Available material

Curated repository PoCs
2

Affected products and versions

1
ProductSourceVersion range

Tickera – WordPress Event Ticketing

CVE List3.4.8.3 to < 3.4.8.3affected

Proofs of concept

2

Curated repository PoCs

GitHubCVE-2021-24797Curated repository PoCby 0xd3vil127Not analyzed1 file

Python · 723 B

GitHub
PoC details
GitHubCVE-2021-24797Curated repository PoCby yubsy112Not analyzed1 file

Python · 723 B

GitHub
PoC details

References

2