install/index.php in Craig Knudsen WebCalendar before 1.2.5 allows remote attackers to…
Priority LOW 37CWE-264Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-264.
Summary
install/index.php in Craig Knudsen WebCalendar before 1.2.5 allows remote attackers to modify settings.php and possibly execute arbitrary code via vectors related to the user theme preference.
Why it matters now
EPSS 0.02173 82nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:webcalendar_project:webcalendar:1.0:rc1:*:*:*:*:*:* | 1.0 rc1 | Vulnerable | Webcalendar Project |
| cpe:2.3:a:webcalendar_project:webcalendar:1.0:rc2:*:*:*:*:*:* | 1.0 rc2 | Vulnerable | Webcalendar Project |
| cpe:2.3:a:webcalendar_project:webcalendar:1.0:rc3:*:*:*:*:*:* | 1.0 rc3 | Vulnerable | Webcalendar Project |
| cpe:2.3:a:webcalendar_project:webcalendar:1.1.1:*:*:*:*:*:*:* | 1.1.1 | Vulnerable | Webcalendar Project |
| cpe:2.3:a:webcalendar_project:webcalendar:1.1.2:*:*:*:*:*:*:* | 1.1.2 | Vulnerable | Webcalendar Project |
| cpe:2.3:a:webcalendar_project:webcalendar:1.1.3:*:*:*:*:*:*:* | 1.1.3 | Vulnerable | Webcalendar Project |
| cpe:2.3:a:webcalendar_project:webcalendar:1.1.4:*:*:*:*:*:*:* | 1.1.4 | Vulnerable | Webcalendar Project |
| cpe:2.3:a:webcalendar_project:webcalendar:1.1.5:*:*:*:*:*:*:* | 1.1.5 | Vulnerable | Webcalendar Project |
| cpe:2.3:a:webcalendar_project:webcalendar:1.1.6:*:*:*:*:*:*:* | 1.1.6 | Vulnerable | Webcalendar Project |
| cpe:2.3:a:webcalendar_project:webcalendar:1.2:b1:*:*:*:*:*:* | 1.2 b1 | Vulnerable | Webcalendar Project |
- cpe:2.3:a:webcalendar_project:webcalendar:1.0:rc1:*:*:*:*:*:* Versions 1.0 rc1 Vulnerable ·Webcalendar Project
- cpe:2.3:a:webcalendar_project:webcalendar:1.0:rc2:*:*:*:*:*:* Versions 1.0 rc2 Vulnerable ·Webcalendar Project
- cpe:2.3:a:webcalendar_project:webcalendar:1.0:rc3:*:*:*:*:*:* Versions 1.0 rc3 Vulnerable ·Webcalendar Project
- cpe:2.3:a:webcalendar_project:webcalendar:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·Webcalendar Project
- cpe:2.3:a:webcalendar_project:webcalendar:1.1.2:*:*:*:*:*:*:* Versions 1.1.2 Vulnerable ·Webcalendar Project
- cpe:2.3:a:webcalendar_project:webcalendar:1.1.3:*:*:*:*:*:*:* Versions 1.1.3 Vulnerable ·Webcalendar Project
- cpe:2.3:a:webcalendar_project:webcalendar:1.1.4:*:*:*:*:*:*:* Versions 1.1.4 Vulnerable ·Webcalendar Project
- cpe:2.3:a:webcalendar_project:webcalendar:1.1.5:*:*:*:*:*:*:* Versions 1.1.5 Vulnerable ·Webcalendar Project
- cpe:2.3:a:webcalendar_project:webcalendar:1.1.6:*:*:*:*:*:*:* Versions 1.1.6 Vulnerable ·Webcalendar Project
- cpe:2.3:a:webcalendar_project:webcalendar:1.2:b1:*:*:*:*:*:* Versions 1.2 b1 Vulnerable ·Webcalendar Project
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:webcalendar_project:webcalendar:1.2.0:*:*:*:*:*:*:* | 1.2.0 | Vulnerable | Webcalendar Project |
| cpe:2.3:a:webcalendar_project:webcalendar:1.2.1:*:*:*:*:*:*:* | 1.2.1 | Vulnerable | Webcalendar Project |
| cpe:2.3:a:webcalendar_project:webcalendar:1.2.2:*:*:*:*:*:*:* | 1.2.2 | Vulnerable | Webcalendar Project |
| cpe:2.3:a:webcalendar_project:webcalendar:1.2.3:*:*:*:*:*:*:* | 1.2.3 | Vulnerable | Webcalendar Project |
| cpe:2.3:a:webcalendar_project:webcalendar:1.2.4:*:*:*:*:*:*:* | 1.2.4 | Vulnerable | Webcalendar Project |
- cpe:2.3:a:webcalendar_project:webcalendar:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·Webcalendar Project
- cpe:2.3:a:webcalendar_project:webcalendar:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·Webcalendar Project
- cpe:2.3:a:webcalendar_project:webcalendar:1.2.2:*:*:*:*:*:*:* Versions 1.2.2 Vulnerable ·Webcalendar Project
- cpe:2.3:a:webcalendar_project:webcalendar:1.2.3:*:*:*:*:*:*:* Versions 1.2.3 Vulnerable ·Webcalendar Project
- cpe:2.3:a:webcalendar_project:webcalendar:1.2.4:*:*:*:*:*:*:* Versions 1.2.4 Vulnerable ·Webcalendar Project
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2012-5385
- 2026-10-03 Alias added: GHSA-mqjj-cmr8-p9p2
References
More Webcalendar Project Webcalendar vulnerabilities
- TI-2012-01308 install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute… CVSS 3.1CRITICAL 9.8
- TI-2024-15086 WebCalendar v1.3.0 was discovered to contain a reflected cross-site scripting (XSS)… CVSS 3.1MEDIUM 6.1
- TI-2023-00274 Cross-site Scripting (XSS) - Stored in craigk5n/webcalendar CVSS 3.1MEDIUM 5.4
- TI-2012-01309 Local file inclusion in WebCalendar before 1.2.5. CVSS 3.1HIGH 8.8
- TI-2017-07941 Cross-site scripting in k5n.us WebCalendar CVSS 3.0MEDIUM 6.1
- TI-2017-07942 Path traversal in k5n.us WebCalendar CVSS 3.0MEDIUM 4.9
Sources
- CVE-2012-5385 · CVE Program
- CVE-2012-5385 · NVD
- FIRST EPSS
- GHSA-mqjj-cmr8-p9p2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences