Threat database

13 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published
High	8.5	EPSS 0.3%	CVE-2026-42633Events Manager · SQL Injection High8.5EPSS 0.3%2026-10-10CVE Database V5CVE-2026-42633 CVE-2026-42633 is a high severity SQL Injection vulnerability affecting Marcus Events Manager versions up to 7.4.6. It involves improper neutralization of special elements in SQL commands related to subscriber data, allowing an attacker with low privileges to execute unauthorized SQL queries. This vulnerability can lead to complete compromise of confidentiality and partial impact on availability, but no integrity loss is indicated. EPSS 0.3%Vulnerability Marcus #cwe-89	CVE Database V5	2026-10-10
High	7.1	EPSS 0.3%	CVE-2026-82883Login With Ajax · Cross-site Scripting High7.1EPSS 0.3%2026-09-02CVE Database V5CVE-2026-82883 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue affects Login With Ajax: from n/a through 4.5.1. EPSS 0.3%Vulnerability Marcus #cwe-79	CVE Database V5	2026-09-02
Medium	6.5	EPSS 0.2%	CVE-2026-66640Login With Ajax · Cross-site Scripting Medium6.5EPSS 0.2%2026-08-18CVE Database V5CVE-2026-66640 Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions. EPSS 0.2%Vulnerability Marcus (aka @msykes)#cwe-79	CVE Database V5	2026-08-18
High	8.8	EPSS 0.5%	CVE-2026-57713Events Manager · Deserialization of Untrusted Data High8.8EPSS 0.5%2026-07-13CVE Database V5CVE-2026-57713 Deserialization of Untrusted Data vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Object Injection.This issue affects Events Manager: from n/a through <= 7.3.6. EPSS 0.5%Vulnerability Marcus (aka @msykes)#cwe-502	CVE Database V5	2026-07-13
High	7.5	EPSS 0.3%	CVE-2026-22351WP FullCalendar · Missing Authorization High7.5EPSS 0.3%2026-02-20CVE Database V5CVE-2026-22351 Missing Authorization vulnerability in Marcus (aka @msykes) WP FullCalendar wp-fullcalendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP FullCalendar: from n/a through <= 1.6. EPSS 0.3%Vulnerability Marcus (aka @msykes)	CVE Database V5	2026-02-20
Medium	5.3	EPSS 0.3%	CVE-2026-24523WP FullCalendar · Exposure of Sensitive System Information to an Unauthorized Control Sphere in Marcus (aka @msykes) WP… Medium5.3EPSS 0.3%2026-01-23CVE Database V5CVE-2026-24523 Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Marcus (aka @msykes) WP FullCalendar wp-fullcalendar allows Retrieve Embedded Sensitive Data.This issue affects WP FullCalendar: from n/a through <= 1.6. EPSS 0.3%Vulnerability Marcus (aka @msykes)	CVE Database V5	2026-01-23
Medium	4.3	EPSS 0.1%	CVE-2025-49967Live Sports Streamthunder · Cross-Site Request Forgery (CSRF) Medium4.3EPSS 0.1%2025-06-20CVE Database V5CVE-2025-49967 Cross-Site Request Forgery (CSRF) vulnerability in marcusjansen Live Sports Streamthunder live-sports-streamthunder allows Cross Site Request Forgery.This issue affects Live Sports Streamthunder: from n/a through <= 2.1. EPSS 0.1%Vulnerability marcusjansen	CVE Database V5	2025-06-20
Medium	5.3	EPSS 0.3%	CVE-2025-1249Events Manager · Missing Authorization Medium5.3EPSS 0.3%2025-02-26CVE Database V5CVE-2025-1249 Missing Authorization vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Events Manager: from n/a through <= 6.6.4.1. EPSS 0.3%Vulnerability Marcus (aka @msykes)	CVE Database V5	2025-02-26
Medium	4.3	EPSS 0.4%	CVE-2025-22260Meta Tag Manager · Missing Authorization Medium4.3EPSS 0.4%2025-02-03CVE Database V5CVE-2025-22260 Missing Authorization vulnerability in Marcus (aka @msykes) Meta Tag Manager meta-tag-manager.This issue affects Meta Tag Manager: from n/a through <= 3.1. EPSS 0.4%Vulnerability Marcus (aka @msykes)	CVE Database V5	2025-02-03
High	7.1	EPSS 0.3%	CVE-2025-22576Site PIN · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Marcus Downing… High7.1EPSS 0.3%2025-01-13CVE Database V5CVE-2025-22576 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus Downing Site PIN site-pin allows Reflected XSS.This issue affects Site PIN: from n/a through <= 1.3. EPSS 0.3%Vulnerability Marcus Downing	CVE Database V5	2025-01-13
Medium	6.5	EPSS 0.3%	CVE-2025-22558mcjh button shortcode · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Marcus C Medium6.5EPSS 0.3%2025-01-07CVE Database V5CVE-2025-22558 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus C. J. Hartmann mcjh button shortcode mcjh-button-shortcode allows Stored XSS.This issue affects mcjh button shortcode: from n/a through <= 1.6.4. EPSS 0.3%Vulnerability Marcus C. J. Hartmann	CVE Database V5	2025-01-07
Medium	6.5	EPSS 0.3%	CVE-2025-22261WP FullCalendar · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Marcus (aka… Medium6.5EPSS 0.3%2025-01-07CVE Database V5CVE-2025-22261 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus (aka @msykes) WP FullCalendar wp-fullcalendar allows Stored XSS.This issue affects WP FullCalendar: from n/a through <= 1.5. EPSS 0.3%Vulnerability Marcus (aka @msykes)	CVE Database V5	2025-01-07

Showing 1–13 of 13 results · 1 duplicate CVE record merged