CVE-2021-42077: Kaysongroup PHP Event Calendar

Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days.

PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/user_manager.php username parameter. This can be used to execute SQL statements directly on the database, allowing an adversary in some cases to completely compromise the database system. It can also be used to bypass the login form.

Affected products

• Kaysongroup PHP Event Calendar: before 2021-09-03 (fixed in 2021-09-03)

Published 2021-11-08. Last modified 2026-06-17.