Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL Injection
82Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 73%
from disclosure to weapon45 days
Published on NVDDec 13
1st PoC+45d
metasploitDec 13
VulnCheckNov 15
exploitation probability
73%top 1% of all CVEs
observed exploitation
yesVulnCheck
2 public exploit(s)
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue
Affected products
Unknown · Modern Events Calendar Litepublic PoCs found — 2
exploitdbwww.exploit-db.com/exploits/50687unverifiedcve_referencepacketstormsecurity.com/files/165742/WordPress-Modern-Events-Calendar-6.1-SQL-Injection.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.