CVE-2021-24946

CVE-2021-24946: Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL Injection

Vendor Unknown

Product Modern Events Calendar Lite

Weakness CWE-89 · SQLi

Published December 13, 2021

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue

Key dates

02Disclosure timeline

December 13, 2021 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-24946 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html