CVE-2024-8369

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access to Private or Password-protected events due to missing authorization checks in all versions up to, and including, 4.0.4.3. This makes it possible for unauthenticated attackers to view private or password-protected events.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
metagaussEventPrime – Events Calendar, Bookings and Tickets<= 4.0.4.3
metagausseventprime<= 4.0.4.3

References

Timeline

Published
Sep 10, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-83705.4A vulnerability classified as problematic was found in Grocy up to 4.2.0. This vulnerability affects unknown code of the file /api/files/recCVE-2024-83724.3Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, whichCVE-2024-83734.3Improper sanitization of the value of the [srcset] attribute in <source> HTML elements in AngularJS allows attackers to bypass common image CVE-2024-83747.8UltiMaker Cura slicer versions 5.7.0-beta.1 through 5.7.2 are vulnerable to code injection via the 3MF format reader (/plugins/ThreeMFReaderCVE-2024-83757.8There exists a use after free vulnerability in Reverb. Reverb supports the VARIANT datatype, which is supposed to represent an arbitrary objCVE-2024-83767.5In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending speCVE-2024-83784.8The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wp_handle_upload, but not for exampCVE-2024-83797.2The Cost Calculator Builder WordPress plugin before 3.2.29 does not properly sanitise and escape a parameter before using it in a SQL statemCVE-2024-83809.8A vulnerability was found in SourceCodester Contact Manager with Export to VCF 1.0. It has been rated as critical. This issue affects some uCVE-2024-83819.8A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environmenCVE-2024-83828.8Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web contCVE-2024-83837.5Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does no