CVE-2004-1654: SQL injection vulnerability in the calendar module in phpWebsite 0.9.3-4 and earlier allows remote attacker...

Security readout for executives and security teams

CVE-2004-1654 is an old phpWebsite flaw where a calendar parameter could let a remote attacker run unwanted database queries. For any organization still hosting phpWebsite 0.9.3-4 or earlier, the business risk is potential data exposure, site manipulation, or database damage. Exposure is likely limited to legacy phpWebsite deployments, especially public sites running 0.9.3-4 or earlier with the calendar module reachable. Modern environments are unlikely exposed unless old phpWebsite code remains online, archived, or embedded in a maintained site. Treat this as a high-priority legacy exposure check, not a broad modern internet emergency. If affected phpWebsite instances exist, prioritize containment and retirement because SQL injection can compromise sensitive database-backed content. Mitigation focus: Inventory public and internal sites for phpWebsite installations.; Retire or replace phpWebsite 0.9.3-4 and earlier where found.; Check vendor and advisory guidance for fixed releases or safe migration paths..

Prepared

Jun 30, 2026, 00:10 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.