CVE-2007-1343
includes/functions.php in Craig Knudsen WebCalendar before 1.0.5 does not protect the noSet...
CVE-2007-1343 is a high vulnerability (CVSS 7.5) in Webcalendar, published March 8, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.18%, the 82nd percentile. Fixed in webcalendar 0.9.45-4sarge6.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 2.18%EPSS, 82nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.9.45-4sarge6webcalendar
Description
includes/functions.php in Craig Knudsen WebCalendar before 1.0.5 does not protect the noSet variable from external modification, which allows remote attackers to set arbitrary global variables via a URL with modified values in the noSet parameter, which leads to resultant vulnerabilities that probably include remote file inclusion and other issues.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
webcalendarDebian:3.1 | before 0.9.45-4sarge6, plus listed versions 0.9.45-40.9.45-4sarge10.9.45-4sarge20.9.45-4sarge30.9.45-4sarge40.9.45-4sarge5 | 0.9.45-4sarge6 |
What each source reports
NVD Score used
includes/functions.php in Craig Knudsen WebCalendar before 1.0.5 does not protect the noSet variable from external modification, which allows remote attackers to set arbitrary global variables via a URL with modified values in the noSet parameter, which leads to resultant vulnerabilities that probably include remote file inclusion and other issues.
- Record
CVE-2007-1343- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
includes/functions.php in Craig Knudsen WebCalendar before 1.0.5 does not protect the noSet variable from external modification, which allows remote attackers to set arbitrary global variables via a URL with modified values in the noSet parameter, which leads to resultant vulnerabilities that probably include remote file inclusion and other issues.
- Record
CVE-2007-1343- Updated
- 2026-11-02
EUVDEUVD-2007-1340No score
includes/functions.php in Craig Knudsen WebCalendar before 1.0.5 does not protect the noSet variable from external modification, which allows remote attackers to set arbitrary global variables via a URL with modified values in the noSet parameter, which leads to resultant vulnerabilities that probably include remote file inclusion and other issues.
- Record
EUVD-2007-1340- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5qjw-rhhh-cjx7No score
includes/functions.php in Craig Knudsen WebCalendar before 1.0.5 does not protect the noSet...
includes/functions.php in Craig Knudsen WebCalendar before 1.0.5 does not protect the noSet variable from external modification, which allows remote attackers to set arbitrary global variables via a URL with modified values in the noSet parameter, which leads to resultant vulnerabilities that probably include remote file inclusion and other issues.
- Record
GHSA-5qjw-rhhh-cjx7- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
vupen.com/english/advisories/2007/0851
webcalendar.cvs.sourceforge.net/webcalendar/webcalendar/includes/functions.php?view=log
sourceforge.net/project/shownotes.php?group_id=3870&release_id=491130
secunia.com/advisories/24519
securityfocus.com/bid/22834
debian.org/security/2007/dsa-1267
Show 6 moreShow less
exchange.xforce.ibmcloud.com/vulnerabilities/32832
nvd.nist.gov/vuln/detail/CVE-2007-1343
github.com/advisories/GHSA-5qjw-rhhh-cjx7