CVE-2021-24946observed exploitationCWE-89

CVE-2021-24946: vulnerability in Modern Events Calendar Lite

Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL Injection

Published · Updated

Follow this CVE+ Monitor Modern Events Calendar Lite

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

82Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actepss 73%
from disclosure to weapon45 days
Published on NVDDec 13
1st PoC+45d
metasploitDec 13
VulnCheckNov 15
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue
Affected products
Unknown · Modern Events Calendar Lite
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Modern Events Calendar Lite

In the same product, most dangerous first.

CVE-2021-24145—Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCEEPSS 87.2%CVE-2022-0364—Modern Events Calendar Lite < 6.4.0 - Contributor+ Stored Cross Site ScriptingEPSS 69.6%CVE-2021-24146—Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events ExportEPSS 31.0%CVE-2021-24149—Modern Events Calendar Lite < 5.16.6 - Authenticated SQL InjectionEPSS 1.5%CVE-2021-24925—Modern Events Calendar Lite < 6.1.5 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2021-24147—Modern Events Calendar Lite < 5.16.5 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.7%