CVE-2021-24147— Wordpress Modern Events Calendar Lite 跨站脚本漏洞
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2021-24147の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Modern Events Calendar Lite < 5.16.5 - Authenticated Stored Cross-Site Scripting (XSS)
ソース: NVD (National Vulnerability Database)
脆弱性説明
Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the mic_comment field (Notes on time) when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting payload in them, which will be triggered in the frontend when viewing the event.
ソース: NVD (National Vulnerability Database)
CVSS情報
N/A
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
Wordpress Modern Events Calendar Lite 跨站脚本漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Wordpress Modern Events Calendar Lite是 （Wordpress）开源的一个应用插件。该插件用于管理事件网站的最佳工具。 WordPress Modern Events Calendar Lite plugin before 5.16.5 存在跨站脚本漏洞，该漏洞允许用户与权限低至作者与跨站点脚本添加事件有效负载。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| Unknown | Modern Events Calendar Lite | 5.16.5 ~ 5.16.5 | - |
II. CVE-2021-24147の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2021-24147のインテリジェンス情報
请登录查看更多情报信息。
CVE-2021-24147 厂商安全公告 (1)
Same Patch Batch · Unknown · 2021-03-18 · 27 CVEs total
| CVE-2021-24136 | Testimonials Widget < 4.0.0 - Multiple Authenticated Stored XSS | |
| CVE-2021-24149 | Modern Events Calendar Lite < 5.16.6 - Authenticated SQL Injection | |
| CVE-2021-24148 | MStore API < 3.2.0 - Authentication Bypass With Sign In With Apple | |
| CVE-2021-24146 | Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events Export | |
| CVE-2021-24145 | Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE | |
| CVE-2021-24144 | Contact Form 7 Database Addon < 1.2.5.6 - CSV Injection | |
| CVE-2021-24143 | AccessPress Social Icons < 1.8.1 - Authenticated SQL Injection | |
| CVE-2021-24142 | 301 Redirects - Easy Redirect Manager < 2.51 - Authenticated SQL Injection | |
| CVE-2021-24141 | Advanced Database Cleaner < 3.0.2 - Authenticated SQL injection | |
| CVE-2021-24140 | Ajax Load More < 5.3.2 - Authenticated SQL Injection | |
| CVE-2021-24139 | Photo Gallery by 10Web < 1.5.55 - Unauthenticated SQL Injection | |
| CVE-2021-24138 | AdRotate < 5.8.4 - Authenticated SQL Injection | |
| CVE-2021-24137 | Blog2Social: Social Media Auto Post & Scheduler < 6.3.1 - Authenticated SQL Injection | |
| CVE-2021-24123 | PowerPress < 8.3.8 - Authenticated Arbitrary File Upload leading to RCE | |
| CVE-2021-24135 | WP Customer Reviews < 3.4.3 - Multiple Unauthenticated and Low Priv Authenticated Stored X | |
| CVE-2021-24134 | Constant Contact Forms < 1.8.8 - Multiple Authenticated Stored XSS | |
| CVE-2021-24133 | ActiveCampaign < 8.0.2 - Cross-Site Request Forgery in Settings | |
| CVE-2021-24132 | Slider by 10Web < 1.2.36 - Multiple Authenticated SQL Injection | |
| CVE-2021-24131 | Anti-Spam by CleanTalk < 5.149 - Multiple Authenticated SQL Injections | |
| CVE-2021-24130 | WP Google Map Plugin < 4.1.5 - Authenticated SQL Injection |
Showing 20 of 27 CVEs. View all on vendor page →
IV. 関連脆弱性
- CVE-2021-4458
Modern Events Calendar Lite <= 6.3.0 - Unauthenticated SQL I - CVE-2025-5733
Modern Events Calendar <= 7.21.9 - Information Exposure - CVE-2023-4021
Modern Events Calendar lite < 7.1.0 - Authenticated (Admin+) - CVE-2023-1400
Modern Events Calendar lite < 6.5.2 - Admin+ Stored XSS - CVE-2022-30533
Modern Events Calendar Lite 跨站脚本漏洞
同じベンダー: Unknown
- CVE-2026-12275
Tutor LMS < 3.9.13 - Subscriber+ Unauthorized Course Enrollm - CVE-2026-12397
WP Job Portal < 2.5.5 - Subscriber+ Employer Email Disclosur - CVE-2026-12582
Library Management System < 3.5.8 - Unauthenticated SQL Inje - CVE-2026-12396
WP Job Portal < 2.5.5 - Subscriber+ Arbitrary Job Approval, - CVE-2026-11964
User Registration & Membership < 5.2.2 - Unauthenticated Pay
同じ弱点: CWE-79
- CVE-2026-44760
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Ap - CVE-2026-44759
Cross Site Scripting (XSS) vulnerability in SAP NetWeaver En - CVE-2026-44752
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Ap - CVE-2026-58487
HedgeDoc: Stored HTML injection via email local-part - CVE-2026-15596
SourceCodester Class and Exam Timetabling System subject.php
V. CVE-2021-24147へのコメント
まだコメントはありません