Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Timetable and Event Schedule by MotoPress < 2.4.0 - Arbitrary User's Hashed Password/Email/Username Disclosure
Vulnerability Description
The Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address (along other less sensitive data) of the user related to the Even Head of the Timeslot in the response when requesting the event Timeslot data with a user with the edit_posts capability. Combined with the other Unauthorised Event Timeslot Modification issue (https://wpscan.com/reports/submissions/4699/) where an arbitrary user ID can be set, this could allow low privilege users with the edit_posts capability (such as author) to retrieve sensitive User data by iterating over the user_id
CVSS Information
N/A
Vulnerability Type
信息暴露
Vulnerability Title
WordPress 插件信息泄露漏洞
Vulnerability Description
WordPress是Wordpress基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress 插件是WordPress开源的一个应用插件。 WordPress Plugin 存在信息泄露漏洞，该漏洞源于 2.4.0 版本之前的 Timetable and Event Schedule 插件在与用户请求事件时间段数据时，在响应中输出与时间段偶数头相关的用户的哈希密码、用户名和电子邮件地址（以及其他不太敏感的数据） 具有 edit_posts 功
CVSS Information
N/A
Vulnerability Type
N/A