4 matches found
CVE-2012-1495
install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form_single_user_login parameter.
CVE-2012-1496
Local file inclusion in WebCalendar before 1.2.5.
CVE-2013-1422
webcalendar before 1.2.7 shows the reason for a failed login (e.g., "no such user").
CVE-2013-1421
Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar before 1.2.5, 1.2.6, and other versions before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the Category Name field to category.php.