Critical severity9.8NVD Advisory· Published Nov 20, 2023· Updated Jun 17, 2026

CVE-2023-46700

Description

SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary SQL command by sending a crafted request, and obtain or alter information stored in the database.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

LuxCal/LuxCal Web Calendarllm-fuzzy
Range: <5.2.4M (MySQL), <5.2.4L (SQLite)
Luxsoft/The Luxcal Web Calendarllm-fuzzy2 versions
<5.2.4M (MySQL), <5.2.4L (SQLite)+ 1 more
- (no CPE)range: <5.2.4M (MySQL), <5.2.4L (SQLite)
- (no CPE)range: prior to 5.2.4L (SQLite version)

Patches

Vulnerability mechanics

References

jvn.jp/en/jp/JVN15005948/nvdThird Party Advisory
www.luxsoft.eunvdProduct
www.luxsoft.eunvdRelease Notes
www.luxsoft.eu/lcforum/viewtopic.phpnvdIssue Tracking

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000