webcalendar webcalendar 0.9.45 vulnerabilities and exploits

(subscribe to this query)

6.4

CVSSv2

SQL injection vulnerability in the user_valid_crypt function in user.php in WebCalendar 0.9.45 allows remote malicious users to execute arbitrary SQL commands via an encoded webcalendar_session cookie.

Webcalendar Webcalendar 0.9.45

7.5

CVSSv2

Multiple PHP remote file inclusion vulnerabilities in WebCalendar 0.9.45 allow remote malicious users to execute arbitrary PHP code via a URL in the includedir parameter to (1) login.php, (2) get_reminders.php, or (3) get_events.php.

K5n Webcalendar 0.9.45

1 EDB exploit

7.5

CVSSv2

includes/functions.php in Craig Knudsen WebCalendar prior to 1.0.5 does not protect the noSet variable from external modification, which allows remote malicious users to set arbitrary global variables via a URL with modified values in the noSet parameter, which leads to resultant...

Webcalendar Webcalendar 1.0.2 Webcalendar Webcalendar 1.0.3 Webcalendar Webcalendar 1.0.0 Webcalendar Webcalendar 1.0.1 Webcalendar Webcalendar 1.0.4

5

CVSSv2

WebCalendar 1.0.1 to 1.0.3 generates different error messages depending on whether or not a username is valid, which allows remote malicious users to enumerate valid usernames.

Webcalendar Webcalendar 1.0.1 Webcalendar Webcalendar 1.0.2 Webcalendar Webcalendar 1.0.3

6.8

CVSSv2

Cross-site scripting (XSS) vulnerability in export_handler.php in WebCalendar 1.0.4 and previous versions allows remote malicious users to inject arbitrary web script or HTML via the format parameter.

Webcalendar Webcalendar 1.0.4

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook