| Package | Affected versions | Patched versions |
|---|---|---|
| totalcalender | = 2.4 |
admin/manage_users.php in TotalCalendar 2.4 does not require administrative authentication, which allows remote attackers to change arbitrary passwords via the newPW1 and newPW2 parameters.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free