Fiche vulnérabilité
CVE-2021-42077 : faille critique kaysongroup php event calendar (CVSS 9.8)
Description
PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/user_manager.php username parameter. This can be used to execute SQL statements directly on the database, allowing an adversary in some cases to completely compromise the database system. It can also be used to bypass the login form.
En bref
- Sévérité
- Critique (CVSS 9.8)
- Vecteur CVSS
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Exploitation active
- Non signalée par la CISA
- Publication
- 8 nov. 2021
- Dernière mise à jour
- 17 juin 2026
Produits concernés
- kaysongroup php event calendar