CyberSec.Space Logo
Back to CVE Browser

CVE-2008-4673

CRITICAL
10.0
CVSS Severity Score
EPSS Score0.0600%
EPSS Percentile24.99th
PublishedOct 22, 2008
Last ModifiedApr 23, 2026

Vulnerability Description

PHP remote file inclusion vulnerability in panel/common/theme/default/header_setup.php in WebBiscuits Software Events Calendar 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the (1) path[docroot] and (2) component parameters.

Affected Platforms (CPE)

📦
Webbiscuits

Events Calendar

= 1.1

References & Advisories

🔗 http://secunia.com/advisories/32053
🔗 http://securityreason.com/securityalert/4461
🔗 http://www.securityfocus.com/bid/31471
🔗 http://www.vupen.com/english/advisories/2008/2701
🔗 https://exchange.xforce.ibmcloud.com/vulnerabilities/45500
🔗 https://www.exploit-db.com/exploits/6623
🔗 http://secunia.com/advisories/32053
🔗 http://securityreason.com/securityalert/4461

Related Vulnerabilities

CVE-2021-420779.8

PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/user_manager.php username parameter...

CVE-2018-63989.8

SQL Injection exists in the CP Event Calendar 3.0.1 component for Joomla! via the id parameter in a task=load action.

CVE-2018-53159.8

The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the event_id parameter to event.php.

CVE-2021-249439.8

The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send...