Sploitus

CVE-2021-24946

6 known exploits for CVE-2021-24946

The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue

Affected products
Modern Events Calendar Lite
Webnus Modern Events Calendar Lite
< 6.1.5
Fix
Available
CVSS 3.1
9.8 CRITICAL
EPSS
72.8% (99th percentile)
Weakness
CWE-89
NVD status
Modified
Published
2021-12-13
CVE-2021-24946 at NVD
Authoritative description, scoring and affected products

6 known exploits for CVE-2021-24946

Proof-of-concept code and exploit modules indexed by Sploitus

WordPress Modern Events Calendar SQL Injection Scanner
2024-09-01 h00die, red0xff, Hacker5preme, metasploit.comPACKETSTORMRuby
WordPress Modern Events Calendar V 6.1 Plugin - SQL Injection (Unauthenticated) Exploit
2022-01-27 Ron JostZDT
WordPress Modern Events Calendar 6.1 SQL Injection
2022-01-27 Ron JostPACKETSTORM
WordPress Plugin Modern Events Calendar V 6.1 - SQL Injection (Unauthenticated)
2022-01-27 Ron JostEXPLOITDB
WordPress Modern Events Calendar SQLi Scanner
2021-12-13 h00die, Hacker5preme (Ron Jost), red0xffMETASPLOITRuby
Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL Injection
2021-11-15 Krzysztof ZajÄ…cWPEXPLOIT