tri vulnerabilities

Products

• gigpress 3
• event tickets 1

Latest tri CVEs

Newest publication first

1. CVE-2021-25028 The Event Tickets WordPress plugin before 5.2.2 does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the given value, leading to an arbitrary redirect issue

   Published 2022-01-24

   Medium·CVSS 6.1

   The Event Tickets WordPress plugin before 5.2.2 does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the given value, leading to an arbitrary redirect issue

2. CVE-2015-9354 The gigpress plugin before 2.3.11 for WordPress has XSS.

   Published 2019-08-28

   Medium·CVSS 4.8

   The gigpress plugin before 2.3.11 for WordPress has XSS.

3. CVE-2015-9353 The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066.

   Published 2019-08-28

   High·CVSS 7.2

   The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066.

4. CVE-2015-4066 Multiple SQL injection vulnerabilities in admin/handlers.php in the GigPress plugin before 2.3.9 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) show_artis...

   Published 2015-05-27

   Medium·CVSS 6.5 Public exploit

   Multiple SQL injection vulnerabilities in admin/handlers.php in the GigPress plugin before 2.3.9 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) show_artist_id or (2) show_venue_id parameter in an add action in the gigpress.php page to...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.