Format string

Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example...

Cross site scripting

Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the miccomment field Notes on time when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting...

Sql injection

Unvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mecpostid POST parameter in the mecfesform AJAX action when logged in as an author+, leading to an authenticated SQL Injection issue...

CVE-2021-24149

Unvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mecpostid POST parameter in the mecfesform AJAX action when logged in as an author+, leading to an authenticated SQL Injection issue...

CVE-2021-24145

Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request...

CVE-2021-24146

Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example...

CVE-2021-24147

Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the miccomment field Notes on time when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting...

CVE-2021-24147

The CVE-2021-24147 entry concerns the WordPress plugin Modern Events Calendar Lite (pre-5.16.5). Affected component: mic_comment field in event creation/editing; root cause is unvalidated input and lack of output encoding, enabling Cross-Site Scripting when events are viewed. Impact is since low-...

CVE-2021-24149

CVE-2021-24149 affects WordPress plugin Modern Events Calendar Lite

CVE-2021-24146

CVE-2021-24146 affects WordPress Modern Events Calendar Lite (versions before 5.16.5). The flaw is lack of proper authorization checks that do not restrict access to exported event files, allowing unauthenticated users to retrieve all events data in CSV or XML formats. Affected plugin: Modern Eve...

CVE-2021-24145

CVE-2021-24145 affects WordPress plugin Modern Events Calendar Lite versions before 5.16.5. The issue is an authenticated arbitrary file upload vulnerability: the plugin does not properly validate the imported file, allowing an administrator or other high-privilege user to upload PHP payloads by ...

CVE-2021-24145 Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE

Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request...

PT-2021-15691 · Unknown · Modern Events Calendar Lite

Name of the Vulnerable Software and Affected Versions: Modern Events Calendar Lite versions prior to 5.16.5 Description: The issue allows for arbitrary file upload due to improper checking of imported files. An administrator can upload PHP files by using the 'text/csv' content-type in the request...

Wordpress Modern Events Calendar Lite SQL注入漏洞

Wordpress Modern Events Calendar Lite is an open source application plugin for Wordpress. The plugin is used to manage the best tools for events website . Wordpress Modern Events Calendar Lite prior to version 5.16.6 suffers from a SQL injection vulnerability that originates from not clearing the...

Wordpress Modern Events Calendar Lite 跨站脚本漏洞

Wordpress Modern Events Calendar Lite is Wordpress open source plugin for an application. The plugin is used to manage the best tools for events website. A cross-site scripting vulnerability exists in the Modern Events Calendar Lite WordPress plugin versions prior to 5.16.5. The vulnerability ste...

Wordpress Modern Events Calendar Lite 代码问题漏洞

Wordpress Modern Events Calendar Lite is an open source application plugin for Wordpress. This plugin is the best tool for managing event websites. A code issue vulnerability exists in the WordPress Modern Events Calendar Lite plugin before 5.16.5, which stems from an arbitrary file upload that...

Wordpress Modern Events Calendar Lite 访问控制错误漏洞

Wordpress Modern Events Calendar Lite is an open source application plugin for Wordpress. This plugin is the best tool for managing event websites. An access control error vulnerability exists in the WordPress Modern Events Calendar Lite plugin before 5.16.5, which stems from not properly...

WordPress Modern Events Calendar Lite plugin <= 5.16.2 - Authenticated Arbitrary File Upload to Remote Code Execution (RCE) vulnerability

Authenticated Arbitrary File Upload to Remote Code Execution RCE vulnerability found by Nguyen Van Khanh in WordPress Modern Events Calendar Lite plugin versions = 5.16.2. Solution Update the WordPress Modern Events Calendar Lite plugin to the latest available version at least 5.16.5...

Modern Events Calendar Lite < 5.16.5 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin did not sanitise the miccomment field Notes on time when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting payload in them, which will be triggered in the frontend when viewing the event. Edit WPScanTeam January 22nd, 2021...

Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events Export

The plugin did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example. PoC https://drive.google.com/file/d/1lLEXDyPp4LcKoCOqYS7A-0YgpIQD-ND/view?usp=sharing...