CVE-2023-46700
CRITICALLuxCal Web Calendar <5.2.4M/5.2.4L - SQL Injection
Title source: llmDescription
SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary SQL command by sending a crafted request, and obtain or alter information stored in the database.
References (4)
Core 4
Core References
Third Party Advisory
https://jvn.jp/en/jp/JVN15005948/
Product
https://www.luxsoft.eu/
Release Notes
https://www.luxsoft.eu/?download
Issue Tracking
https://www.luxsoft.eu/lcforum/viewtopic.php?id=476
Scores
CVSS v3
9.8
EPSS
0.0103
EPSS Percentile
59.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-89
Status
published
Products (2)
luxsoft/luxcal_web_calendar
< 5.2.4l
luxsoft/luxcal_web_calendar
< 5.2.4m
Published
Nov 20, 2023
Tracked Since
Feb 18, 2026