PT-2025-31765 · Unknown · Mocca Calendar

Name of the Vulnerable Software and Affected Versions: Mocca Calendar versions prior to 2.15 Description: The Mocca Calendar application is susceptible to a cross-site scripting XSS issue. This issue occurs through manipulation of the title field when viewing an event page. Recommendations: Updat...

CVE-2024-37396

A stored cross-site scripting XSS vulnerability in the Calendar function of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Notes' field of a calendar event. This could lead to the execution of malicious scripts when the...

REDCap 跨站脚本漏洞

REDCap is a data collection and management web application from the REDCap open source. A cross-site scripting vulnerability exists in REDCap version 13.1.9, which stems from a stored cross-site scripting vulnerability in the Calendar functionality, and could lead to the execution of arbitrary we...

CVE-2024-21658

discourse-calendar is a discourse plugin which adds the ability to create a dynamic calendar in the first post of a topic. The limit on region value length is too generous. This allows a malicious actor to cause a Discourse instance to use excessive bandwidth and disk space. This issue has been...

CVE-2024-25151

The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not escape user supplied data in the default notification email template, which allows remote...

CVE-2023-52198

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Michiel van Eerd Private Google Calendars allows Stored XSS.This issue affects Private Google Calendars: from n/a through 20231125...

CVE-2022-41351

In Zimbra Collaboration Suite ZCS 8.8.15, at the URL /h/calendar, one can trigger XSS by adding JavaScript code to the view parameter and changing the value of the uncheck parameter to a string instead of default value of 10...

CVE-2022-24838

Nextcloud Calendar is a calendar application for the nextcloud framework. SMTP Command Injection in Appointment Emails via Newlines: as newlines and special characters are not sanitized in the email value in the JSON request, a malicious attacker can inject newlines to break out of the RCPT TO:...

CVE-2021-26746

Chamilo 1.11.14 allows XSS via a main/calendar/agendalist.php?type= URI...

CVE-2020-5615

Cross-site request forgery CSRF vulnerability in Calendar01 free edition ver1.0.0 and Calendar02 free edition ver1.0.0 allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2011-3254

Cross-site scripting XSS vulnerability in Calendar in Apple iOS before 5 allows remote attackers to inject arbitrary web script or HTML via an invitation note...

CVE-2004-2574

Cross-site scripting XSS vulnerability in index.php in phpGroupWare 0.9.14.005 and earlier allows remote attackers to inject arbitrary web script or HTML via the date parameter in a calendar.uicalendar.planner menuaction...

CVE-2024-8700 Event Calendar <= 1.0.4 - Unauthenticated Arbitrary Calendar Deletion

The Event Calendar WordPress plugin through 1.0.4 does not check for authorization on delete actions, allowing unauthenticated users to delete arbitrary calendars...

CVE-2024-8700

CVE-2024-8700 affects the WordPress plugin Event Calendar (versions up to 1.0.4). The issue is lack of authorization checks on delete actions, allowing unauthenticated users to delete calendars. The connected sources confirm the vulnerability exists but do not provide a fixed version or patch det...

CVE-2024-8700 Event Calendar <= 1.0.4 - Unauthenticated Arbitrary Calendar Deletion

The Event Calendar WordPress plugin through 1.0.4 does not check for authorization on delete actions, allowing unauthenticated users to delete arbitrary calendars...

CVE-2025-46510

CVE-2025-46510 describes a CSRF to Stored XSS vulnerability in the WordPress plugin Contact Form 7 Calendar (harrysudana) affecting versions up to 3.0.1. The issue enables stored XSS via a CSRF, with CVSS v3.1 base score 7.1 (HIGH). No exploitation status is confirmed in the provided documents. R...

SUSE CVE-2011-3827

The iCalendar component in gwwww1.dll in GroupWise Internet Agent GWIA in Novell GroupWise 8.0 before Support Pack 3 allows remote attackers to cause a denial of service out-of-bounds read and daemon crash via a crafted date-time string in a .ics attachment...

CVE-2025-31589

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kibru Demeke Ethiopian Calendar ethiopian-calendar allows Stored XSS.This issue affects Ethiopian Calendar: from n/a through = 1.1.1...

ROS-20250326-10

A vulnerability in the Nextcloud calendar cloud software application for creating and utilizing a Nextcloud data warehouse is related to the failure to clean up line breaks and special characters in the email value in a JSON request. Exploitation of the vulnerability could allow an attacker actin...

CVE-2025-1159 CampCodes School Management Software academic-calendar cross site scripting

A vulnerability was found in CampCodes School Management Software 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /academic-calendar. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit h...