CVE-2013-1422

webcalendar before 1.2.7 shows the reason for a failed login e.g., "no such user"...

CVE-2012-5385

install/index.php in Craig Knudsen WebCalendar before 1.2.5 allows remote attackers to modify settings.php and possibly execute arbitrary code via vectors related to the user theme preference...

CVE-2012-5384

Multiple cross-site scripting XSS vulnerabilities in Craig Knudsen WebCalendar allow remote attackers to inject arbitrary web script or HTML via the 1 $name or 2 $description variables in editentryhandler.php, or 3 $url, 4 $tempfullname, or 5 $extusers variables in viewentry.php, different vector...

CVE-2011-3695

111WebCalendar 1.2.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by footer.php and certain other files...

CVE-2005-2320

WebCalendar before 1.0.0 does not properly restrict access to assistantedit.php, which allows remote attackers to gain privileges...

CVE-2002-2065

WebCalendar 0.9.34 and earlier with 'browsing in includes directory' enabled allows remote attackers to read arbitrary include files with .inc extensions from the web root...

CVE-2024-1097

A stored cross-site scripting XSS vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report,...

CVE-2024-1097

A stored cross-site scripting XSS vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report,...

CVE-2024-1097

A stored cross-site scripting XSS vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report,...

CVE-2024-1097

CVE-2024-1097: A stored XSS in craigk5n/webcalendar 1.3.0 occurs in the Report Name input during report creation. Malicious scripts can run in other users’ context, potentially enabling theft of user accounts and cookies. Public details about a fix are not provided in the connected sources; no pa...

CVE-2024-1097 Stored XSS in craigk5n/webcalendar

A stored cross-site scripting XSS vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report,...

CVE-2024-1097 Stored XSS in craigk5n/webcalendar

A stored cross-site scripting XSS vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report,...

WebCalendar 安全漏洞

WebCalendar is a PHP application by Craig Knudsen, an individual developer, used to maintain calendars for individual users or groups of Intranet users. A security vulnerability exists in WebCalendar version 1.3.0, which stems from vulnerability to cross-site scripting attacks that could lead to...

PT-2024-16673 · Craigk5N · Webcalendar

Name of the Vulnerable Software and Affected Versions: craigk5n/webcalendar version 1.3.0 Description: A stored cross-site scripting XSS issue exists in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of...

WebCalendar Cross-Site Scripting Vulnerability

WebCalendar is a PHP application for maintaining calendars for individual users or groups of Intranet users. It can also be configured as an event calendar. WebCalendar v1.3.0 suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of...

CVE-2024-22635

WebCalendar v1.3.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the component /WebCalendarvqsmnseug2/editentry.php...

Cross site scripting

WebCalendar v1.3.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the component /WebCalendarvqsmnseug2/editentry.php...

CVE-2024-22635

WebCalendar v1.3.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the component /WebCalendarvqsmnseug2/editentry.php...

WebCalendar 安全漏洞

WebCalendar is a PHP application for maintaining calendars for individual users or groups of Intranet users. It can also be configured as an event calendar. WebCalendar v1.3.0 suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of...

CVE-2024-22635

WebCalendar v1.3.0 contains a reflected cross-site scripting (XSS) vulnerability in the /WebCalendarvqsmnseug2/edit_entry.php component. The root cause is insufficient filtering/escaping of user-supplied data, enabling execution of arbitrary script or HTML in a victim’s browser. Public references...