CVE-2023-46700

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary SQL command by sending a crafted request, and obtain or alter information stored in the database.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
LuxSoft	LuxCal Web Calendar	prior to 5.2.4M (MySQL version)
LuxSoft	LuxCal Web Calendar	prior to 5.2.4L (SQLite version)

References

https://jvn.jp/en/jp/JVN15005948/Third Party Advisory
https://www.luxsoft.eu/Product
https://www.luxsoft.eu/?downloadRelease Notes
https://www.luxsoft.eu/lcforum/viewtopic.php?id=476Issue Tracking
https://jvn.jp/en/jp/JVN15005948/Third Party Advisory
https://www.luxsoft.eu/Product
https://www.luxsoft.eu/?downloadRelease Notes
https://www.luxsoft.eu/lcforum/viewtopic.php?id=476Issue Tracking

Timeline

Published: Nov 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-467015.3Mattermost fails to perform authorization checks in the /plugins/playbooks/api/v0/runs/add-to-timeline-dialog endpoint of the Playbooks plu CVE-2023-467055.5in OpenHarmony v3.2.2 and prior versions allow a local attacker causes system information leak through type confusion.CVE-2023-467069.8Multiple MachineSense devices have credentials unable to be changed by the user or administrator.CVE-2023-467087.8in OpenHarmony v3.2.4 and prior versions allow a local attacker arbitrary code execution in any apps through use after free.CVE-2023-46719.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Talent Software ECOP allows Command Li CVE-2023-467114.6VR-S1000 firmware Ver. 2.37 and earlier uses a hard-coded cryptographic key which may allow an attacker to analyze the password of a specifi CVE-2023-467128.8A improper access control in Fortinet FortiPortal version 7.0.0 through 7.0.6, Fortinet FortiPortal version 7.2.0 through 7.2.1 allows attac CVE-2023-467135.3An improper output neutralization for logs in Fortinet FortiWeb 6.2.0 - 6.2.8, 6.3.0 - 6.3.23, 7.0.0 - 7.0.9, 7.2.0 - 7.2.5 and 7.4.0 may al CVE-2023-467147.2A stack-based buffer overflow [CWE-121] vulnerability in Fortinet FortiOS version 7.2.1 through 7.2.6 and version 7.4.0 through 7.4.1 allows CVE-2023-467154.3An origin validation error [CWE-346] vulnerability in Fortinet FortiOS IPSec VPN version 7.4.0 through 7.4.1 and version 7.2.6 and below al CVE-2023-467178.8An improper authentication vulnerability [CWE-287] in FortiOS versions 7.4.1 and below, versions 7.2.6 and below, and versions 7.0.12 and be CVE-2023-467187.8A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.12 and 6.4.6 thr