CVE-2005-3949
Multiple SQL injection vulnerabilities in WebCalendar 1.0.1 allow remote attackers to execute...
CVE-2005-3949 is a high vulnerability (CVSS 7.5) in Webcalendar, published December 1, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.11%, the 82nd percentile. No source names a fixed version.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 2.11%EPSS, 82nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Multiple SQL injection vulnerabilities in WebCalendar 1.0.1 allow remote attackers to execute arbitrary SQL commands via the (1) startid parameter to activity_log.php, (2) startid parameter to admin_handler.php, (3) template parameter to edit_template.php, and (4) multiple parameters to export_handler.php.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
webcalendarDebian:3.1 From an advisory covering 4 CVEs | before 0.9.45-4sarge3, plus listed versions 0.9.45-40.9.45-4sarge10.9.45-4sarge2 | 0.9.45-4sarge3 |
What each source reports
NVD Score used
Multiple SQL injection vulnerabilities in WebCalendar 1.0.1 allow remote attackers to execute arbitrary SQL commands via the (1) startid parameter to activity_log.php, (2) startid parameter to admin_handler.php, (3) template parameter to edit_template.php, and (4) multiple parameters to export_handler.php.
- Record
CVE-2005-3949- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
Multiple SQL injection vulnerabilities in WebCalendar 1.0.1 allow remote attackers to execute arbitrary SQL commands via the (1) startid parameter to activity_log.php, (2) startid parameter to admin_handler.php, (3) template parameter to edit_template.php, and (4) multiple parameters to export_handler.php.
- Record
CVE-2005-3949- Updated
- 2026-11-02
EUVDEUVD-2005-3944No score
Multiple SQL injection vulnerabilities in WebCalendar 1.0.1 allow remote attackers to execute arbitrary SQL commands via the (1) startid parameter to activity_log.php, (2) startid parameter to admin_handler.php, (3) template parameter to edit_template.php, and (4) multiple parameters to export_handler.php.
- Record
EUVD-2005-3944- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-whhr-fp2m-r32mNo score
Multiple SQL injection vulnerabilities in WebCalendar 1.0.1 allow remote attackers to execute...
Multiple SQL injection vulnerabilities in WebCalendar 1.0.1 allow remote attackers to execute arbitrary SQL commands via the (1) startid parameter to activity_log.php, (2) startid parameter to admin_handler.php, (3) template parameter to edit_template.php, and (4) multiple parameters to export_handler.php.
- Record
GHSA-whhr-fp2m-r32m- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
secunia.com/advisories/17784
securityfocus.com/archive/1/418286/100/0/threaded
osvdb.org/21219
exchange.xforce.ibmcloud.com/vulnerabilities/23369
Show 13 moreShow less
vupen.com/english/advisories/2005/2643
securityreason.com/securityalert/215
ush.it/2005/11/28/webcalendar-multiple-vulnerabilities
sourceforge.net/forum/forum.php?thread_id=1392833&forum_id=11587
debian.org/security/2006/dsa-1002
nvd.nist.gov/vuln/detail/CVE-2005-3949
github.com/advisories/GHSA-whhr-fp2m-r32m