CVE Browser

JoomSport <= 5.7.9 - Authenticated (Administrator+) SQL Injection via 'order' Parameter

JoomSport <= 5.7.9 - Authenticated (Contributor+) SQL Injection via 'event' Shortcode Attribute

JoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Creation/Modification via season_groupedit AJAX action

JoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Deletion via season_groupdel AJAX action

WordPress JoomSport plugin <= 5.7.7 - SQL Injection vulnerability

JoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' Parameter

JoomSport <= 5.7.3 - Unauthenticated Directory Traversal to Local File Inclusion

JoomSport <= 5.6.17 - Reflected Cross-Site Scripting via page

WordPress JoomSport plugin <= 5.3.0 - Broken Access Control vulnerability

WordPress JoomSport plugin <= 5.6.3 - Broken Access Control vulnerability

JoomSport < 5.2.8 - Unauthenticated SQLi

JoomSport – for Sports: Team & League, Football, Hockey & more <= 5.2.5 - Authenticated (Admin+) SQL Injection via orderby

JoomSport – for Sports: Team & League, Football, Hockey & more <= 5.2.5 - Authentciated (Admin+) SQL Injection via orderby

JoomSport < 5.1.8 - Unauthenticated PHP Object Injection

The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport_season/new-yorkers/?acti…