Webcalendar

Records19All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high8CVSS 7.0–8.9

Exploited now

Webcalendar records in CISA KEV

No Webcalendar vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Webcalendar 18 records MEDIUM Web Calendar Pro 1 record LOW

Records

18 records in Webcalendar · all components

TI-2001-00469 CVE-2001-0477 · GHSA-c7h7-cjhx-gphr

Vulnerability in WebCalendar 0.9.26 allows remote command execution.

MEDIUM 40

Vulnerability in WebCalendar 0.9.26 allows remote command execution.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.04043 Published 2001-05-24 No fix listed

TI-2007-01288 CVE-2007-1343 · GHSA-5qjw-rhhh-cjx7

includes/functions.php in Craig Knudsen WebCalendar before 1.0.5 does not protect the…

LOW 37

includes/functions.php in Craig Knudsen WebCalendar before 1.0.5 does not protect the noSet variable from external modification, which allows remote attackers to set arbitrary global variables via a URL with modified val…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02184 Published 2007-03-08 No fix listed

TI-2005-03742 CVE-2005-3949 · GHSA-whhr-fp2m-r32m

Multiple SQL injection vulnerabilities in WebCalendar 1.0.1 allow remote attackers to…

LOW 37

Multiple SQL injection vulnerabilities in WebCalendar 1.0.1 allow remote attackers to execute arbitrary SQL commands via the (1) startid parameter to activity_log.php, (2) startid parameter to admin_handler.php, (3) temp…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02109 Published 2005-12-01 No fix listed

TI-2005-02580 CVE-2005-2717 · GHSA-5hq7-h62w-3v89

PHP remote file inclusion vulnerability in WebCalendar before 1.0.1 allows remote…

LOW 37

PHP remote file inclusion vulnerability in WebCalendar before 1.0.1 allows remote attackers to execute arbitrary PHP code when opening settings.php, possibly via send_reminders.php or other scripts.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02021 Published 2005-08-29 No fix listed

TI-2005-02197 CVE-2005-2320 · GHSA-mcm8-xf94-x8qf

WebCalendar before 1.0.0 does not properly restrict access to assistant_edit.php, which…

LOW 36

WebCalendar before 1.0.0 does not properly restrict access to assistant_edit.php, which allows remote attackers to gain privileges.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01432 Published 2005-07-19 No fix listed

TI-2004-01384 CVE-2004-1508 · GHSA-h2cc-j5j2-fjjw

init.php in WebCalendar allows remote attackers to execute arbitrary local PHP scripts via the user_inc parameter.

LOW 36

init.php in WebCalendar allows remote attackers to execute arbitrary local PHP scripts via the user_inc parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01625 Published 2005-02-19 No fix listed

TI-2005-03776 CVE-2005-3984 · GHSA-8m2x-mm2c-xh64

SQL injection vulnerability in WebCalendar 1.0.1 allows remote attackers to execute…

LOW 35

SQL injection vulnerability in WebCalendar 1.0.1 allows remote attackers to execute arbitrary SQL commands via the time_range parameter to edit_report_handler.php.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01271 Published 2005-12-04 No fix listed CWE-89

TI-2006-06413 CVE-2006-6669 · GHSA-6xqp-5jcx-vcqq

Cross-site scripting (XSS) vulnerability in export_handler.php in WebCalendar 1.0.4 and…

LOW 33

Cross-site scripting (XSS) vulnerability in export_handler.php in WebCalendar 1.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01442 Published 2006-12-20 No fix listed

TI-2006-02670 CVE-2006-2762 · GHSA-m998-g3mj-58r7

PHP remote file inclusion vulnerability in includes/config.php in WebCalendar 1.0.3…

LOW 33

PHP remote file inclusion vulnerability in includes/config.php in WebCalendar 1.0.3 allows remote attackers to execute arbitrary PHP code via a URL in the includedir parameter, which is remotely accessed in an fopen call…

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.02169 Published 2006-06-02 No fix listed

TI-2005-03774 CVE-2005-3982 · GHSA-p95x-f93r-h96r

CRLF injection vulnerability in layers_toggle.php in WebCalendar 1.0.1 might allow remote…

LOW 33

CRLF injection vulnerability in layers_toggle.php in WebCalendar 1.0.1 might allow remote attackers to modify HTTP headers and conduct HTTP response splitting attacks via the ret parameter, which is used to redirect URL…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.07076 Published 2005-12-04 No fix listed

TI-2005-00431 CVE-2005-0474 · GHSA-4mmm-jj36-wmc5

SQL injection vulnerability in the user_valid_crypt function in user.php in WebCalendar…

LOW 31

SQL injection vulnerability in the user_valid_crypt function in user.php in WebCalendar 0.9.45 allows remote attackers to execute arbitrary SQL commands via an encoded webcalendar_session cookie.

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.01442 Published 2005-02-19 No fix listed

TI-2006-01487 CVE-2006-1537 · GHSA-x2hp-cgpc-j5q4

Craig Knudsen WebCalendar 1.1.0-CVS allows remote attackers to obtain sensitive…

LOW 27

Craig Knudsen WebCalendar 1.1.0-CVS allows remote attackers to obtain sensitive information via a direct request to (1) includes/index.php, (2) tests/add_duration_test.php, (3) tests/all_tests.php, (4) groups.php, (5) no…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02306 Published 2006-03-30 No fix listed

TI-2005-03754 CVE-2005-3961 · GHSA-j5xw-6p2w-wwpf

export_handler.php in WebCalendar 1.0.1 allows remote attackers to overwrite WebCalendar…

LOW 27

export_handler.php in WebCalendar 1.0.1 allows remote attackers to overwrite WebCalendar data files via a modified id parameter.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02161 Published 2005-12-01 No fix listed

TI-2006-02188 CVE-2006-2247 · GHSA-437p-pvrc-cr2c

WebCalendar 1.0.1 to 1.0.3 generates different error messages depending on whether or not…

LOW 26

WebCalendar 1.0.1 to 1.0.3 generates different error messages depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01695 Published 2006-05-09 No fix listed

TI-2004-01383 CVE-2004-1507 · GHSA-45c3-gq5g-3rq7

CRLF injection vulnerability in login.php in WebCalendar allows remote attackers to…

LOW 26

CRLF injection vulnerability in login.php in WebCalendar allows remote attackers to inject CRLF sequences via the return_path parameter and perform HTTP Response Splitting attacks to modify expected HTML content from the…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01473 Published 2005-02-19 No fix listed

TI-2002-01984 CVE-2002-2065 · GHSA-gr8x-chfr-hp52

WebCalendar 0.9.34 and earlier with 'browsing in includes directory' enabled allows…

LOW 26

WebCalendar 0.9.34 and earlier with 'browsing in includes directory' enabled allows remote attackers to read arbitrary include files with .inc extensions from the web root.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01581 Published 2005-07-14 No fix listed

TI-2004-01382 CVE-2004-1506 · GHSA-jgf2-f2cv-9q4x

Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar allow remote attackers…

LOW 23

Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar allow remote attackers to inject arbitrary web script via (1) view_entry.php, (2) view_d.php, (3) usersel.php, (4) datesel.php, (5) trailer.php, or (6) s…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01283 Published 2005-02-19 No fix listed

TI-2007-06391 CVE-2007-6696 · GHSA-cw2q-7r7v-77r7

Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar 1.1.6 allow remote…

LOW 15

Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar 1.1.6 allow remote attackers to inject arbitrary web script or HTML via (1) an event description, (2) the query string to pref.php, and (3) the adv param…

CVSS 2.0LOW 2.1 Network Low privileges Interaction — EPSS 0.01732 Published 2008-02-01 No fix listed CWE-79

Open these records in search →

Critical	0
High	8
Medium	10
Low	1
No CVSS	0