Vulnerabilities > Webnus > Modern Events Calendar Lite > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-03-18 | CVE-2021-24149 | SQL Injection vulnerability in Webnus Modern Events Calendar Lite Unvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mec[post_id] POST parameter in the mec_fes_form AJAX action when logged in as an author+, leading to an authenticated SQL Injection issue. | 8.8 |
| 2021-03-18 | CVE-2021-24146 | Missing Authorization vulnerability in Webnus Modern Events Calendar Lite Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example. | 7.5 |
| 2021-03-18 | CVE-2021-24145 | Unspecified vulnerability in Webnus Modern Events Calendar Lite Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request. | 7.2 |