CVE-2005-3984

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

SQL injection vulnerability in WebCalendar 1.0.1 allows remote attackers to execute arbitrary SQL commands via the time_range parameter to edit_report_handler.php. NOTE: the startid/activity_log.php vector is already covered by CVE-2005-3949.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/17848Patch, Vendor Advisory
http://vd.lwang.org/webcalendar_multiple_vulns.txtVendor Advisory
http://www.osvdb.org/21382
http://www.securityfocus.com/archive/1/418286/100/0/threaded
http://www.vupen.com/english/advisories/2005/2702Vendor Advisory
http://secunia.com/advisories/17848Patch, Vendor Advisory
http://vd.lwang.org/webcalendar_multiple_vulns.txtVendor Advisory
http://www.osvdb.org/21382
http://www.securityfocus.com/archive/1/418286/100/0/threaded
http://www.vupen.com/english/advisories/2005/2702Vendor Advisory

Timeline

Published: Dec 4, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-39857.8The Internet Key Exchange version 1 (IKEv1) implementation in Astaro Security Linux before 6.102 allows remote attackers to cause a denial o CVE-2005-39867.5Multiple SQL injection vulnerabilities in Instant Photo Gallery 1 and earlier allow remote attackers to execute arbitrary SQL commands via t CVE-2005-39877.5Multiple SQL injection vulnerabilities in Tradesoft CMS allow remote attackers to execute arbitrary SQL commands via unspecified attack vect CVE-2005-39887.5SQL injection vulnerability in article.php in Pineapple Technologies Lore 1.5.4 allows remote attackers to execute arbitrary SQL commands vi CVE-2005-39897.8Memory leak in Avaya TN2602AP IP Media Resource 320 circuit pack before vintage 9 firmware allows remote attackers to cause a denial of serv CVE-2005-39914.3Multiple cross-site scripting (XSS) vulnerabilities in phpMyChat 0.14.6 allow remote attackers to inject arbitrary web script or HTML via th CVE-2005-39927.5Multiple buffer overflows in WinEggDropShell remote access trojan (RAT) 1.7 allow remote attackers to execute arbitrary code via (1) a long CVE-2005-39937.8Multiple unspecified vulnerabilities in MailEnable Professional 1.6 and earlier and Enterprise 1.1 and earlier allow attackers to cause a de CVE-2005-39955.1Format string vulnerability in the dosyslog function in the OBEX server (obexsrv.c) for Sobexsrv before 1.0.0-pre4, when the syslog (-S) fun CVE-2005-39965.1SQL injection vulnerability in admin/password_forgotten.php in Zen Cart 1.2.6d and earlier allows remote attackers to execute arbitrary SQL CVE-2005-39972.6Zen Cart 1.2.6d and earlier, under certain PHP configurations, allows remote attackers to obtain sensitive information via direct requests t CVE-2005-39984.3Cross-site scripting (XSS) vulnerability in search.asp in Solupress News 1.0 and earlier allows remote attackers to inject arbitrary web scr