CVE-2013-3961

MediumCVSS 6.5/10Last modified Jun 16, 2026

Description

SQL injection vulnerability in edit_event.php in Simple PHP Agenda before 2.2.9 allows remote authenticated users to execute arbitrary SQL commands via the eventid parameter.

Metrics

CVSS 2.0 6.5/10AV:N/AC:L/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/94141Broken Link
http://packetstormsecurity.com/files/121978/Simple-PHP-Agenda-2.2.8-SQL-Injection.htmlExploit, Third Party Advisory
http://seclists.org/fulldisclosure/2013/Jun/67Exploit, Issue Tracking
http://www.exploit-db.com/exploits/26136Exploit
http://www.securityfocus.com/bid/60481Exploit, Third Party Advisory
http://www.webera.fr/advisory-02-php-agenda-isql-exploitExploit, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/84938
http://osvdb.org/94141Broken Link
http://packetstormsecurity.com/files/121978/Simple-PHP-Agenda-2.2.8-SQL-Injection.htmlExploit, Third Party Advisory
http://seclists.org/fulldisclosure/2013/Jun/67Exploit, Issue Tracking
http://www.exploit-db.com/exploits/26136Exploit
http://www.securityfocus.com/bid/60481Exploit, Third Party Advisory
http://www.webera.fr/advisory-02-php-agenda-isql-exploitExploit, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/84938

Timeline

Published: Mar 11, 2014
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-39624.3Cross-site scripting (XSS) vulnerability in Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV36 CVE-2013-39636.8Cross-site request forgery (CSRF) vulnerability in goform/usermanage in Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, G CVE-2013-39644.3Cross-site scripting (XSS) vulnerability in Samsung SHR-5162, SHR-5082, and possibly other models, allows remote attackers to inject arbitra CVE-2013-39696.5The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a denial of service (u CVE-2013-39704.3Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS 7.0r2 through 7.0r8 and 7.1r1 through 7.1r5 and Junos Pulse Access Contr CVE-2013-39714.0IBM Maximo Asset Management 7.1 through 7.1.1.12 and 7.5 before 7.5.0.5 allows remote authenticated users to bypass intended access restrict CVE-2013-39724.0IBM Maximo Asset Management 7.1 before 7.1.1.12 and 7.5 before 7.5.0.5 allows remote authenticated users to obtain sensitive information via CVE-2013-39736.5SQL injection vulnerability in IBM Maximo Asset Management 7.1 before 7.1.1.12 and 7.5 before 7.5.0.5 allows remote authenticated users to e CVE-2013-39755.0Unspecified vulnerability in the Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to disco CVE-2013-39762.1The (1) Data Protection for Exchange component 6.1 before 6.1.3.4 and 6.3 before 6.3.1 in IBM Tivoli Storage Manager for Mail and the (2) Fl CVE-2013-39774.3The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to determine which meeting rooms are CVE-2013-39785.0The Meeting Server in IBM Sametime 8.5.2 through 8.5.2.1 and 9.x through 9.0.0.1 does not send the appropriate HTTP response headers to prev