CVE-2021-42077

PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/user_manager.php username parameter. This can be used to execute SQL statements directly on the database, allowing an adversary in some cases to completely compromise the database system. It can also be used to bypass the login form.

• CWE-89

• http://packetstormsecurity.com/files/164777/PHP-Event-Calendar-Lite-Edition-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-048.txtExploit, Third Party Advisory
• http://packetstormsecurity.com/files/164777/PHP-Event-Calendar-Lite-Edition-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-048.txtExploit, Third Party Advisory

Published

Nov 8, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-42071In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attack…9.8
• CVE-2021-42072An issue was discovered in Barrier before 2.4.0. The barrier…8.8
• CVE-2021-42073An issue was discovered in Barrier before 2.4.0. An attacker…8.2
• CVE-2021-42074An issue was discovered in Barrier before 2.3.4. An unauthen…7.5
• CVE-2021-42075An issue was discovered in Barrier before 2.3.4. The barrier…7.5
• CVE-2021-42076An issue was discovered in Barrier before 2.3.4. An attacker…7.5
• CVE-2021-42078PHP Event Calendar through 2021-11-04 allows persistent cros…6.1
• CVE-2021-42079An authenticated administrator is able to prepare an alert t…4.9
• CVE-2021-4208The ExportFeed WordPress plugin through 2.0.1.0 does not san…7.2
• CVE-2021-42080An attacker is able to launch a Reflected XSS attack using a…7.4
• CVE-2021-42081An authenticated administrator is allowed to remotely execut…7.2
• CVE-2021-42082Local users are able to execute scripts under root privilege…7.8