CVE-2012-1495

WebCalendar is affected by CVE-2012-1495: install/index.php in WebCalendar versions before 1.2.5 allows remote code execution via the form_single_user_login parameter (pre-auth). The vulnerability enables arbitrary code execution with web user privileges and has multiple public references detaili...

CVE-2023-0289

CVE-2023-0289 - Stored XSS in WebCalendar affects the GitHub project webcalendar; affected software is the WebCalendar application (versions prior to master). The vulnerability is a stored cross-site scripting issue in the location field when creating or viewing events, leading to script executio...

CVE-2017-10841

CVE-2017-10841 affects WebCalendar 1.2.7 and earlier, with a directory traversal vulnerability that allows authenticated attackers to read arbitrary files via unspecified vectors. Affected software is WebCalendar (PHP-based calendar application); impact is partial confidentiality loss for targete...

CVE-2017-10840

CVE-2017-10840 affects WebCalendar 1.2.7 and earlier, enabling cross-site scripting (XSS) to inject arbitrary web script or HTML via unspecified vectors. Connected sources corroborate the vulnerability and note that upstream fixed it in a newer release (WebCalendar 1.2.8) and that Fedora updates ...

CVE-2012-1496

CVE-2012-1496 affects WebCalendar prior to 1.2.5. Multiple sources document local file inclusion (LFI) in WebCalendar, with OpenVAS also listing PHP code injection in WebCalendar 1.2.4. The common impact is arbitrary file read and potential code execution within the vulnerable web application con...

CVE-2024-22635

WebCalendar v1.3.0 contains a reflected cross-site scripting (XSS) vulnerability in the /WebCalendarvqsmnseug2/edit_entry.php component. The root cause is insufficient filtering/escaping of user-supplied data, enabling execution of arbitrary script or HTML in a victim’s browser. Public references...

CVE-2012-5384

CVE-2012-5384 and related entries describe multiple cross-site scripting (XSS) vulnerabilities in Craig Knudsen WebCalendar. The flaws allow remote attackers to inject arbitrary script/HTML by manipulating parameters in edit_entry_handler.php (name/description) and view_entry.php (url, tempfullna...

CVE-2013-1422

CVE-2013-1422 affects webCalendar (WebCalendar) prior to version 1.2.7. The flaw is that failed-login responses leak the reason (e.g., “no such user”), enabling user enumeration by an attacker via authentication attempts. The vulnerability is tied to the login error messaging rather than a fully ...

CVE-2013-1421

CVE-2013-1421 affects Craig Knudsen WebCalendar prior to 1.2.7 (including 1.2.5 and 1.2.6). The issue is a Cross-Site Scripting (XSS) vulnerability in the Category Name field processed by category.php, enabling remote attackers to inject arbitrary web script or HTML. Affected versions and impact ...

CVE-2012-5385

CVE-2012-5385 affects Craig Knudsen WebCalendar prior to 1.2.5. The vulnerability is in install/index.php, where remote attackers can modify settings.php and potentially execute arbitrary code via vectors related to the user theme preference. The CVE documents do not provide exploitation details ...