CVE-2012-1495: WebCalendar install/index.php pre-auth remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityPre-authentication remote code execution with a critical CVSS score, public exploit code and very high EPSS probability makes this an urgent patch target.

What it is

WebCalendar before 1.2.5 passes the form_single_user_login parameter in install/index.php without adequate sanitisation, allowing injection that leads to arbitrary code execution. The flaw is remotely reachable and, per the CVSS vector, needs no authentication or user interaction, so any exposed installation is at risk.

Impact

An attacker can execute arbitrary code on the server, gaining full control of the WebCalendar host and any data or credentials it holds.

Attack surface

Reached over the network through install/index.php with the form_single_user_login parameter; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required.

Exploitation

CISA KEV does not list this CVE, but public exploit code exists (Packet Storm and Exploit-DB references tagged Exploit) and EPSS is very high at roughly 0.798 (99.6th percentile), indicating substantial real-world exploitation likelihood.

What to do

• Upgrade WebCalendar to 1.2.5 or later, which the release notes identify as the fixed version.
• If upgrade is not immediately possible, remove or block external access to install/index.php and the install directory.
• Restrict network access to the WebCalendar instance to trusted users or internal networks only.
• After patching, review server logs and file integrity for signs of injected or modified PHP files.

Detection

• Inspect web server logs for requests to install/index.php, especially with unusual or encoded form_single_user_login values.
• Alert on POST requests to install paths from unauthenticated or unexpected source addresses.
• Monitor for new or modified PHP files under the web root and for unexpected outbound connections from the WebCalendar host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.