cincycalendar.com XSS vulnerability

Vulnerable URL: http://www.cincycalendar.com/cgi-bin/calendar/calendar.pl?year="'--!=Eventid=5353 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP websit...

CVE-2005-1148

calendar.pl in CalendarScript 3.21 allows remote attackers to obtain sensitive information via invalid 1 year or 2 month parameters, which leaks the full pathname and debug information...

CVE-2005-1146

CalendarScript 3.21 is affected by a Cross‑Site Scripting (XSS) flaw in the login command (calendar.pl) via the username parameter. The issue is documented as CVE-2005-1146 and is noted by some sources as disputed by the vendor. Connected sources also reference CalendarScript 3.21 alongside previ...

CVE-2005-1147

CVE-2005-1147 affects CalendarScript 3.20’s calendar.pl, where remote attackers can trigger information disclosure through invalid (1) calendar or (2) template parameters. The issue leaks the full pathname and debug information, revealing sensitive data and indicating a flaw in input validation f...

CVE-2005-1148

CalendarScript 3.21's calendar.pl is vulnerable to information disclosure: remote attackers can trigger invalid year or month parameters to leak the full path and debug info. Affected: calendar.pl in CalendarScript 3.21. Root cause: improper handling of year/month input leads to leakage of filesy...

PT-2005-2161 · Calendarscript · Calendarscript

Name of the Vulnerable Software and Affected Versions: CalendarScript version 3.20 Description: A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the template parameter in the calendar.pl file. This issue is disputed by the vendor...

PT-2005-2162 · Calendarscript · Calendarscript

Name of the Vulnerable Software and Affected Versions: CalendarScript version 3.21 Description: A cross-site scripting XSS issue exists in the login command of calendar.pl, allowing remote attackers to inject arbitrary web script or HTML via the username parameter. Recommendations: For...