CVE-2023-3219

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Jul 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-321907.8mlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable by abusing insecure file operations that run with CVE-2023-321919.9When RKE provisions a cluster, it stores the cluster state in a configmap called `full-cluster-state` inside the `kube-system` namespace of CVE-2023-321928.3A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in the API Server's public API endpoint can be exp CVE-2023-321938.3A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in Norman's public API endpoint can be exploited. T CVE-2023-321947.2A vulnerability has been identified when granting a create or * global role for a resource type of "namespaces"; no matter the API group, th CVE-2023-321966.6A vulnerability has been identified whereby privilege escalation checks are not properly enforced for RoleTemplateobjects when external=true CVE-2023-321976.6A Improper Privilege Management vulnerability in SUSE rancher in RoleTemplateobjects when external=true is set can lead to privilege escalat CVE-2023-321988.0A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presente CVE-2023-321994.3A vulnerability has been identified within Rancher Manager, where after removing a custom GlobalRole that gives administrative access or t CVE-2023-32205.5An issue was discovered in the Linux kernel through 6.1-rc8. dpu_crtc_atomic_check in drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c lacks check o CVE-2023-322008.8There is insufficient restrictions of called script functions in Apache Jena versions 4.8.0 and earlier. It allows a remote user to execut CVE-2023-322017.8Stack-based buffer overflow vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. Opening a specially crafted SIM2 file may le