title: Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL Injection
description: The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue
problem types: CWE-89 SQL Injection
affected:
{
product: Modern Events Calendar Lite
vendor: Unknown
versions:
lessThan: 6.1.5, status: affected, version: 6.1.5, versionType: custom
}