modern_events_calendar_lite 漏洞

严重CVE-2021-24946SQL注入2021/12/13

WordPress Modern Events Calendar <6.1.5 - Blind SQL Injection

WordPress Modern Events Calendar plugin before 6.1.5 is susceptible to blind SQL injection. The plugin does not sanitize and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

PoC 已收录modern_events_calendar_lite

CVSS9.8EPSS 72.8%

高危CVE-2021-24146信息泄露2021/03/19

WordPress Modern Events Calendar Lite <5.16.5 - Sensitive Information Disclosure

WordPress Modern Events Calendar Lite before 5.16.5 does not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format.

PoC 已收录modern_events_calendar_lite

CVSS7.5EPSS 31.0%

高危CVE-2021-24145远程代码执行2021/03/19

WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload

WordPress Modern Events Calendar Lite plugin before 5.16.5 is susceptible to authenticated arbitrary file upload. The plugin does not properly check the imported file, allowing PHP files to be uploaded and/or executed by an administrator or other high-privilege user using the text/csv content-type in the request. This can possibly lead to remote code execution.

PoC 已收录RCEmodern_events_calendar_lite

CVSS7.2EPSS 87.2%

modern_events_calendar_lite

关联漏洞

WordPress Modern Events Calendar <6.1.5 - Blind SQL Injection

WordPress Modern Events Calendar Lite <5.16.5 - Sensitive Information Disclosure

WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload