GCVE - cpe:2.3:a:php_lite:calendar_express:2.2:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:php_lite:calendar_express:2.2:*:*:*:*:*:*:*

part: a version: 2.2 update: *

Vendor	Php Lite (`48d87f05-7993-53be-b917-3c4a33214ea8`)
Product	Calendar Express (`a67da0e6-77b7-5c40-8edc-06e96b6d0040`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2007-3627`	vulnerable	2026-06-08 04:49:54.383908	Details available Multiple SQL injection vulnerabilities in PHP Lite Calendar Express 2.2 allow remote attackers to execute arbitrary SQL commands via the cid parameter to (1) login.php, (2) auth.php, and (3) subscribe.php. NOTE: the month.php, year.php, week.php, and day.php vectors are already covered by CVE-2005-4009. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Published: 2007-07-09T16:00:00.000Z Updated: 2024-09-17T03:37:46.075Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/14504	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-2973`	vulnerable	2026-06-08 04:49:07.980022	Details available Multiple SQL injection vulnerabilities in month.php in PHP Lite Calendar Express 2.2 allow remote attackers to execute arbitrary SQL commands via the (1) catid and (2) cid parameter. NOTE: this might be a duplicate of CVE-2005-4009.c. Published: 2006-06-12T22:00:00.000Z Updated: 2024-08-07T18:06:27.231Z Open on db.gcve.eu Reference links http://securityreason.com/securityalert/1089 http://www.vupen.com/english/advisories/2006/2220 http://www.securityfocus.com/archive/1/436334/100/0/threaded http://www.securityfocus.com/bid/18314	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-1401`	vulnerable	2026-06-08 04:48:57.113679	Details available Multiple cross-site scripting (XSS) vulnerabilities in search.php in Calendar Express 2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) allwords or (2) oneword parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information. Published: 2006-03-28T11:00:00.000Z Updated: 2024-08-07T17:12:20.867Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/17240 https://exchange.xforce.ibmcloud.com/vulnerabilities/25467 http://secunia.com/advisories/19393 http://www.vupen.com/english/advisories/2006/1109 http://www.osvdb.org/24161	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4009`	vulnerable	2026-06-08 04:48:42.833794	Details available Multiple SQL injection vulnerabilities in PHP Lite Calendar Express 2.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) cid and (2) catid parameters to (a) day.php, (b) week.php, (c) month.php, and (d) year.php. Published: 2005-12-05T11:00:00.000Z Updated: 2024-08-07T23:31:48.950Z Open on db.gcve.eu Reference links http://pridels0.blogspot.com/2005/11/calendar-express-2-sql-inj-vuln.html http://www.osvdb.org/21403 http://www.osvdb.org/21405 http://www.osvdb.org/21402	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.