WS-2023-0144

Stored XSS was found in Week View Plugin in anuko/timetracker before 1.22.12.5783. An attacker can take advantage of insufficient control of the user input on the POST parameter note to inject arbitrary javascript code that will be permanently stored. In this way, the input entered by the attacke...

CVE-2023-32066 Time Tracker has Stored XSS vulnerability in Week View plugin

Time Tracker is an open source time tracking system. The week view plugin in Time Tracker versions 1.22.11.5782 and prior was not escaping titles for notes in week view table. Because of that, it was possible for a logged in user to enter notes with elements of JavaScript. Such script could then ...

CVE-2023-32066

Time Tracker is an open source time tracking system. The week view plugin in Time Tracker versions 1.22.11.5782 and prior was not escaping titles for notes in week view table. Because of that, it was possible for a logged in user to enter notes with elements of JavaScript. Such script could then ...

PT-2023-23580

Name of the Vulnerable Software and Affected Versions Time Tracker versions 1.22.11.5782 and prior Description The week view plugin in Time Tracker was not escaping titles for notes in the week view table, allowing a logged-in user to enter notes with JavaScript elements. This could lead to the...

CVE-2023-32066: Improper Neutralization of Input During Web Page Generation

Time Tracker is an open source time tracking system. The week view plugin in Time Tracker versions 1.22.11.5782 and prior was not escaping titles for notes in week view table. Because of that, it was possible for a logged in user to enter notes with elements of JavaScript. Such script could then ...

CVE-2010-0636

Multiple cross-site scripting XSS vulnerabilities in WebCalendar 1.2.0, and other versions before 1.2.5, allow remote attackers to inject arbitrary web script or HTML via the 1 tab parameter to users.php and the PATHINFO to 2 day.php, 3 month.php, and 4 week.php. NOTE: some of these details are...

CVE-2008-4620

SQL injection vulnerability in Meeting Room Booking System MRBS before 1.4 allows remote attackers to execute arbitrary SQL commands via the area parameter to 1 month.php, and possibly 2 day.php and 3 week.php...

CVE-2008-4620: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Meeting Room Booking System MRBS before 1.4 allows remote attackers to execute arbitrary SQL commands via the area parameter to 1 month.php, and possibly 2 day.php and 3 week.php...

CVE-2008-3565

Multiple cross-site scripting XSS vulnerabilities in Meeting Room Booking System MRBS 1.2.6 allow remote attackers to inject arbitrary web script or HTML via the area parameter to 1 day.php, 2 week.php, 3 month.php, 4 search.php, 5 report.php, and 6 help.php. NOTE: the provenance of this...

CVE-2008-3565: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Meeting Room Booking System MRBS 1.2.6 allow remote attackers to inject arbitrary web script or HTML via the area parameter to 1 day.php, 2 week.php, 3 month.php, 4 search.php, 5 report.php, and 6 help.php. NOTE: the provenance of this...

CVE-2008-2783

Multiple cross-site scripting XSS vulnerabilities in Horde Groupware, Groupware Webmail Edition, and Kronolith allow remote attackers to inject arbitrary web script or HTML via the timestamp parameter to 1 week.php, 2 workweek.php, and 3 day.php; and 4 the horde parameter in the PATHINFO to the...

phpical-xss.txt

PHP iCalendar alertdocument.cookie //---------------------------------------\ Greetz To: All Hackers Jose Luis Góngora Fernández / JosS!...

CVE-2006-4906: Undefined Security Weakness

SQL injection vulnerability in modules/calendar/week.php in More.groupware 0.74 allows remote attackers to execute arbitrary SQL commands via the newcalendarid parameter...

CVE-2006-2798

Multiple cross-site scripting XSS vulnerabilities in phpCommunityCalendar 4.0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 LoName parameter in a week.php and b month.php and 2 AddressLink parameter in c event.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in phpCommunityCalendar 4.0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 LoName parameter in a week.php and b month.php and 2 AddressLink parameter in c event.php...

CVE-2006-2798: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in phpCommunityCalendar 4.0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 LoName parameter in a week.php and b month.php and 2 AddressLink parameter in c event.php...

CVE-2005-4009: Undefined Security Weakness

Multiple SQL injection vulnerabilities in PHP Lite Calendar Express 2.2 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 cid and 2 catid parameters to a day.php, b week.php, c month.php, and d year.php...

CVE-2005-2882

Multiple cross-site scripting XSS vulnerabilities in phpCommunityCalendar 4.0.3, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via the LocationID parameter to 1 thankyou.php or 2 day.php, font parameter to 3 calDaily.php, 4 calMonthly.php, 5...

CVE-2005-2880: Undefined Security Weakness

Multiple SQL injection vulnerabilities in phpCommunityCalendar 4.0.3, and possibly earlier versions, allow remote attackers to execute arbitrary SQL commands via the 1 login field in login.php or 2 LocationID parameter to week.php...