Vulnerabilities > WEB Dorado > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2017-07-07 | CVE-2017-2224 | Cross-site Scripting vulnerability in Web-Dorado Event Calendar WD Cross-site scripting vulnerability in Event Calendar WD prior to version 1.0.94 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 4.3 |
| 2015-06-15 | CVE-2015-4352 | Cross-Site Request Forgery (CSRF) vulnerability in Web-Dorado Spider Video Player Cross-site request forgery (CSRF) vulnerability in the Spider Video Player module for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete videos via unspecified vectors. | 5.8 |
| 2015-06-15 | CVE-2015-4351 | Permissions, Privileges, and Access Controls vulnerability in Web-Dorado Spider Video Player The Spider Video Player module for Drupal allows remote authenticated users with the "access Spider Video Player administration" permission to delete arbitrary files via a crafted URL. | 4.9 |
| 2015-06-15 | CVE-2015-4350 | Cross-Site Request Forgery (CSRF) vulnerability in Web-Dorado Spider Catalog Multiple cross-site request forgery (CSRF) vulnerabilities in the Spider Catalog module for Drupal allow remote attackers to hijack the authentication of administrators for requests that delete (1) products, (2) ratings, or (3) categories via unspecified vectors. | 6.8 |
| 2015-02-11 | CVE-2015-1582 | Cross-site Scripting vulnerability in Web-Dorado Spider Facebook 1.0.10 Multiple cross-site scripting (XSS) vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the appid parameter in a registration task to the default URI or remote administrators to inject arbitrary web script or HTML via the (2) asc_or_desc, (3) order_by, (4) page_number, (5) serch_or_not, or (6) search_events_by_title parameter in (a) the Spider_Facebook_manage page to wp-admin/admin.php or a (b) selectpagesforfacebook or (c) selectpostsforfacebook action to wp-admin/admin-ajax.php. | 4.3 |
| 2014-11-04 | CVE-2014-8584 | Cross-Site Scripting vulnerability in Web-Dorado Spider Video Player Cross-site scripting (XSS) vulnerability in the Web Dorado Spider Video Player (aka WordPress Video Player) plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 4.3 |