VulnerabilityModified
CVE-2006-0206
Eval injection vulnerability in Light Weight Calendar (LWC) 1.0 (20040909) and earlier allows remote attackers to execute arbitrary PHP code via the date parameter in cal.php, which is included by index.php.
HIGH 7.5EPSS 4.28%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.28%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Eval injection vulnerability in Light Weight Calendar (LWC) 1.0 (20040909) and earlier allows remote attackers to execute arbitrary PHP code via the date parameter in cal.php, which is included by index.php.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 4.28% probability · 91th percentile
- CISA KEV
- Not listed
- Affected
- light weight calendar/light weight calendar
- Source
- cve@mitre.org
References
- http://attrition.org/pipermail/vim/2006-March/000612.html
- http://evuln.com/vulns/29/exploit.htmlExploit
- http://evuln.com/vulns/29/summary.htmlExploit, Vendor Advisory
- http://secunia.com/advisories/18450Exploit, Vendor Advisory
- http://www.osvdb.org/22376
- http://www.securityfocus.com/archive/1/421920
- http://www.securityfocus.com/bid/16229Exploit
- http://www.vupen.com/english/advisories/2006/0171
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24110
- http://attrition.org/pipermail/vim/2006-March/000612.html
- http://evuln.com/vulns/29/exploit.htmlExploit
- http://evuln.com/vulns/29/summary.htmlExploit, Vendor Advisory
- http://secunia.com/advisories/18450Exploit, Vendor Advisory
- http://www.osvdb.org/22376
- http://www.securityfocus.com/archive/1/421920
- http://www.securityfocus.com/bid/16229Exploit
- http://www.vupen.com/english/advisories/2006/0171
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24110
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.