CVE-2005-2880

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Multiple SQL injection vulnerabilities in phpCommunityCalendar 4.0.3, and possibly earlier versions, allow remote attackers to execute arbitrary SQL commands via the (1) login field in login.php or (2) LocationID parameter to week.php.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=112605610624004&w=2
http://rgod.altervista.org/phpccal.htmlExploit, Vendor Advisory
http://secunia.com/advisories/16721/Vendor Advisory
http://www.securityfocus.com/bid/14763Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/22175
http://marc.info/?l=bugtraq&m=112605610624004&w=2
http://rgod.altervista.org/phpccal.htmlExploit, Vendor Advisory
http://secunia.com/advisories/16721/Vendor Advisory
http://www.securityfocus.com/bid/14763Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/22175

Timeline

Published: Sep 14, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-28817.5phpCommunityCalendar 4.0.3 allows remote attackers to bypass authentication and gain unauthorized access via a direct request to the admin d CVE-2005-28824.3Multiple cross-site scripting (XSS) vulnerabilities in phpCommunityCalendar 4.0.3, and possibly earlier versions, allow remote attackers to CVE-2005-28844.3Cross-site scripting (XSS) vulnerability in events.php in Land Down Under (LDU) 801 and earlier allows remote attackers to inject arbitrary CVE-2005-28857.5The Downloads page in MAXdev MD-Pro 1.0.73, and possibly earlier versions, uses an incomplete blacklist to check for dangerous file extensio CVE-2005-28864.3Multiple cross-site scripting (XSS) vulnerabilities in MAXdev MD-Pro 1.0.73, and possibly earlier versions, allow remote attackers to inject CVE-2005-28875.0MAXdev MD-Pro 1.0.73, and possibly earlier versions, allows remote attackers to obtain sensitive information via a direct request to (1) wik CVE-2005-28887.5Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) Preview Release 2 allow remote attackers to execute arbitrary SQL commands CVE-2005-28897.5Check Point NGX R60 does not properly verify packets against the predefined service group "CIFS" rule, which allows remote attackers to bypa CVE-2005-28904.6SecureOL VE2 1.05.1008 does not properly restrict public access to physical memory, which allows local users to bypass intended restrictions CVE-2005-28916.4WebArchiveX.dll 5.5.0.76 installed before September 6th, 2005 is marked safe for scripting by default, which allows remote attackers to read CVE-2005-28925.0Directory traversal vulnerability in setcookie.php in PBLang 4.65, and possibly earlier versions, allows remote attackers to read arbitrary CVE-2005-28937.5Direct static code injection vulnerability in setcookie.php in PBLang 4.65, and possibly earlier versions, allows remote attackers to execut