CVE-2007-1483

CVE-2007-1483 affects WebCalendar 0.9.45 with multiple PHP remote file inclusion vulnerabilities. The flaw allows an attacker to supply a URL in the includedir parameter to one of three scripts (login.php, get_reminders.php, get_events.php), enabling arbitrary PHP code execution on the affected s...

CVE-2012-0846

CVE-2012-0846 is an XSS vulnerability in Craig Knudsen WebCalendar 1.2.4 that allows remote injection of arbitrary scripts/HTML via the Location variable. The connected records for CVE-2012-5384 describe additional XSS vectors affecting the same WebCalendar product (including parameters in edit_e...

CVE-2024-1097

CVE-2024-1097: A stored XSS in craigk5n/webcalendar 1.3.0 occurs in the Report Name input during report creation. Malicious scripts can run in other users’ context, potentially enabling theft of user accounts and cookies. Public details about a fix are not provided in the connected sources; no pa...

CVE-2010-0637

WebCalendar 1.2.0 and earlier (up to 1.2.5) are vulnerable to multiple CSRF flaws that can hijack administrator sessions to perform actions such as deleting events or banning IPs. The issue affects the product as described in CVE-2010-0637 with a CVSS base score of 6.8 (network, medium complexity...

CVE-2010-0636

WebCalendar 1.2.0 and all versions before 1.2.5 are vulnerable to multiple XSS flaws. An attacker can inject arbitrary script via the tab parameter to users.php and via PATH_INFO to day.php, month.php, and week.php. The issue stems from insufficient input sanitization. Upgrading to 1.2.5 or later...

CVE-2008-2836

CVE-2008-2836 is a PHP remote file inclusion vulnerability in WebCalendar 1.0.4. The flaw resides in send_reminders.php, allowing an attacker to include a URL via the includedir parameter and a 0 value for the noSet parameter to execute arbitrary PHP code. This is a different vector from CVE-2007...

CVE-2010-0638

CVE-2010-0638 affects WebCalendar 1.2.0, where a CSRF flaw allows remote attackers to hijack administrator sessions and perform password changes. The exact exploitation vectors are not detailed in the provided documents. OpenVAS notes multiple CSRF (and XSS) vulnerabilities in WebCalendar and ind...

CVE-2011-3814

WebCalendar 1.2.3 (and earlier up to 1.2.4/1.2.5 line) is affected by an information-disclosure vulnerability where remote attackers can obtain sensitive data by directly requesting certain PHP files, exposing the installation path in error messages (notably ws/user_mod.php). Affected version ran...