CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Deserialization of Untrusted Data vulnerability in Stiofan Events Calendar for GeoDirectory events-for-geodirectory allows Object Injection.This issue affects Events Calendar for GeoDirectory: from n/a through <= 2.3.14.
Explanation of Vulnerability in Simple Terms
Events Calendar for GeoDirectory versions up to 2.3.14 contain a deserialization vulnerability that allows authenticated users to execute arbitrary code on the site. An attacker with low-level access can craft malicious serialized data to trigger code execution. This affects all installations running the vulnerable version range.
What an attacker can do
Run their own code on the site with full access to the database and files.
Potential impact on your site
Any authenticated user can compromise the entire site, steal data, modify content, or install backdoors.
Conditions required to exploit
Attacker must have a low-privilege user account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
