CVE-2013-3961: SQL injection vulnerability in edit_event.php in Simple PHP Agenda before 2.2.9 allows remote authenticated...

Security readout for executives and security teams

CVE-2013-3961 is a SQL injection flaw in Simple PHP Agenda before 2.2.9. An authenticated remote user could abuse the event editing path to run SQL against the application database. Business risk depends on whether this old PHP agenda application is still deployed and reachable. Exposure is likely limited to organizations still running Simple PHP Agenda versions before 2.2.9, especially internet-facing or shared instances with multiple authenticated users. The source bundle does not identify CPEs or affected package metadata. Prioritize this if Simple PHP Agenda is still deployed, especially on an internet-facing site. The product appears old, but database compromise risk is meaningful where affected versions remain in use. If not deployed, no action is needed beyond confirming asset inventory. Mitigation focus: Upgrade Simple PHP Agenda to version 2.2.9 or later where deployed.; If upgrade status is unclear, check original vendor or project guidance before applying changes.; Restrict access to the agenda application to trusted users and networks..

Prepared

Jun 14, 2026, 14:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.