WebCalendar allows remote attackers to gain privileges by modifying critical parameters…
Priority LOW 38Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
WebCalendar allows remote attackers to gain privileges by modifying critical parameters to (1) view_entry.php or (2) upcoming.php.
Why it matters now
EPSS 0.02722 86th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 30
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:webcalendar:webcalendar:0.9.8:*:*:*:*:*:*:* | 0.9.8 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.11:*:*:*:*:*:*:* | 0.9.11 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.15:*:*:*:*:*:*:* | 0.9.15 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.16:*:*:*:*:*:*:* | 0.9.16 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.19:*:*:*:*:*:*:* | 0.9.19 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.20:*:*:*:*:*:*:* | 0.9.20 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.21:*:*:*:*:*:*:* | 0.9.21 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.22:*:*:*:*:*:*:* | 0.9.22 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.23:*:*:*:*:*:*:* | 0.9.23 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.24:*:*:*:*:*:*:* | 0.9.24 | Running on | Webcalendar |
- cpe:2.3:a:webcalendar:webcalendar:0.9.8:*:*:*:*:*:*:* Versions 0.9.8 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.11:*:*:*:*:*:*:* Versions 0.9.11 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.15:*:*:*:*:*:*:* Versions 0.9.15 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.16:*:*:*:*:*:*:* Versions 0.9.16 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.19:*:*:*:*:*:*:* Versions 0.9.19 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.20:*:*:*:*:*:*:* Versions 0.9.20 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.21:*:*:*:*:*:*:* Versions 0.9.21 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.22:*:*:*:*:*:*:* Versions 0.9.22 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.23:*:*:*:*:*:*:* Versions 0.9.23 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.24:*:*:*:*:*:*:* Versions 0.9.24 Running on ·Webcalendar
Show 20 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:webcalendar:webcalendar:0.9.25:*:*:*:*:*:*:* | 0.9.25 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.26:*:*:*:*:*:*:* | 0.9.26 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.27:*:*:*:*:*:*:* | 0.9.27 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.28:*:*:*:*:*:*:* | 0.9.28 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.29:*:*:*:*:*:*:* | 0.9.29 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.30:*:*:*:*:*:*:* | 0.9.30 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.31:*:*:*:*:*:*:* | 0.9.31 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.32:*:*:*:*:*:*:* | 0.9.32 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.33:*:*:*:*:*:*:* | 0.9.33 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.34:*:*:*:*:*:*:* | 0.9.34 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.35:*:*:*:*:*:*:* | 0.9.35 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.36:*:*:*:*:*:*:* | 0.9.36 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.37:*:*:*:*:*:*:* | 0.9.37 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.38:*:*:*:*:*:*:* | 0.9.38 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.39:*:*:*:*:*:*:* | 0.9.39 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.40:*:*:*:*:*:*:* | 0.9.40 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.41:*:*:*:*:*:*:* | 0.9.41 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.42:*:*:*:*:*:*:* | 0.9.42 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.43:*:*:*:*:*:*:* | 0.9.43 | Running on | Webcalendar |
| cpe:2.3:a:webcalendar:webcalendar:0.9.44:*:*:*:*:*:*:* | 0.9.44 | Running on | Webcalendar |
- cpe:2.3:a:webcalendar:webcalendar:0.9.25:*:*:*:*:*:*:* Versions 0.9.25 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.26:*:*:*:*:*:*:* Versions 0.9.26 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.27:*:*:*:*:*:*:* Versions 0.9.27 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.28:*:*:*:*:*:*:* Versions 0.9.28 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.29:*:*:*:*:*:*:* Versions 0.9.29 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.30:*:*:*:*:*:*:* Versions 0.9.30 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.31:*:*:*:*:*:*:* Versions 0.9.31 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.32:*:*:*:*:*:*:* Versions 0.9.32 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.33:*:*:*:*:*:*:* Versions 0.9.33 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.34:*:*:*:*:*:*:* Versions 0.9.34 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.35:*:*:*:*:*:*:* Versions 0.9.35 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.36:*:*:*:*:*:*:* Versions 0.9.36 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.37:*:*:*:*:*:*:* Versions 0.9.37 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.38:*:*:*:*:*:*:* Versions 0.9.38 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.39:*:*:*:*:*:*:* Versions 0.9.39 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.40:*:*:*:*:*:*:* Versions 0.9.40 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.41:*:*:*:*:*:*:* Versions 0.9.41 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.42:*:*:*:*:*:*:* Versions 0.9.42 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.43:*:*:*:*:*:*:* Versions 0.9.43 Running on ·Webcalendar
- cpe:2.3:a:webcalendar:webcalendar:0.9.44:*:*:*:*:*:*:* Versions 0.9.44 Running on ·Webcalendar
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2004-1510
- 2026-10-03 Alias added: GHSA-fhcr-cp2p-9qx3
References
Sources
- CVE-2004-1510 · CVE Program
- CVE-2004-1510 · NVD
- FIRST EPSS
- GHSA-fhcr-cp2p-9qx3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences