CVE-2005-0474: Webcalendar

Medium severity, CVSS 6.4. EPSS: 1.4% chance of exploitation in the next 30 days.

SQL injection vulnerability in the user_valid_crypt function in user.php in WebCalendar 0.9.45 allows remote attackers to execute arbitrary SQL commands via an encoded webcalendar_session cookie.

Affected products

• Webcalendar Webcalendar: version 0.9.45 only

Published 2005-03-30. Last modified 2026-06-16.