Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

WebCalendar 1.0.1 lets attackers run database commands

CVE-2005-3949 · published 20 years ago
Summary

The WebCalendar version 1.0.1 web application can be tricked into executing unwanted database instructions when certain fields are supplied, such as startid or template. This could allow an attacker to view, change, or delete calendar data. Upgrade to a newer version of WebCalendar or apply the vendor’s patches to stop the misuse.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
webcalendar webcalendar 1.0.1
cpe:2.3:a:webcalendar:webcalendar:1.0.1:*:*:*:*:*:*:*
Original advisory text
Multiple SQL injection vulnerabilities in WebCalendar 1.0.1 allow remote attackers to execute arbitrary SQL commands via the (1) startid parameter to activity_log.php, (2) startid parameter to admi...
Multiple SQL injection vulnerabilities in WebCalendar 1.0.1 allow remote attackers to execute arbitrary SQL commands via the (1) startid parameter to activity_log.php, (2) startid parameter to admin_handler.php, (3) template parameter to edit_template.php, and (4) multiple parameters to export_handler.php.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Timeline
Published1 Dec 2005
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2005-3949 · NVD
Track software like this
Free during beta