← Back

Totalcalender

totalcalender

Vendor: Sweetphp • 1 CVE

CVEs (1)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2009-4929
1Sweetphp
1Totalcalender
Apr 29, 2026
Jul 12, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
admin/manage_users.php in TotalCalendar 2.4 does not require administrative authentication, which allows remote attackers to change arbitrary passwords via the newPW1 and newPW2 parameters.