CVE-2004-1507: Webcalendar

Medium severity, CVSS 5.0. EPSS: 1.5% chance of exploitation in the next 30 days.

CRLF injection vulnerability in login.php in WebCalendar allows remote attackers to inject CRLF sequences via the return_path parameter and perform HTTP Response Splitting attacks to modify expected HTML content from the server.

Affected products

• Webcalendar Webcalendar: version 0.9.8 only; version 0.9.11 only; version 0.9.15 only; version 0.9.16 only; version 0.9.19 only; version 0.9.20 only; …

Published 2004-12-31. Last modified 2026-06-16.