TI-2024-01017 CVE-2024-1097 · GHSA-8j99-75gr-3jf5
Stored XSS in craigk5n/webcalendar
Priority MEDIUM 58
A stored cross-site scripting (XSS) vulnerability exists in craigk5n/webcalendar version 1.3.0.
K5n
Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
K5n records in CISA KEVNo K5n vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
8 records in Webcalendar · all components
TI-2007-01425 CVE-2007-1483 · GHSA-fvv8-w6rh-m9pr
Multiple PHP remote file inclusion vulnerabilities in WebCalendar 0.9.45 allow remote…
Priority MEDIUM 40
Multiple PHP remote file inclusion vulnerabilities in WebCalendar 0.9.45 allow remote attackers to execute arbitrary PHP code via a URL in the includedir parameter to (1) login.php, (2) get_reminders.php, or (3) get_even…
TI-2008-02710 CVE-2008-2836 · GHSA-c32q-m2jw-8jp8
PHP remote file inclusion vulnerability in send_reminders.php in WebCalendar 1.0.4 allows…
Priority LOW 38
PHP remote file inclusion vulnerability in send_reminders.php in WebCalendar 1.0.4 allows remote attackers to execute arbitrary PHP code via a URL in the includedir parameter and a 0 value for the noSet parameter, a diff…
TI-2010-00607 CVE-2010-0638 · GHSA-75wq-g7g6-fpm6
Cross-site request forgery (CSRF) vulnerability in WebCalendar 1.2.0 allows remote…
Priority LOW 31
Cross-site request forgery (CSRF) vulnerability in WebCalendar 1.2.0 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via unknown vectors.
TI-2010-00606 CVE-2010-0637 · GHSA-4j4j-45pm-jf8h
Multiple cross-site request forgery (CSRF) vulnerabilities in WebCalendar 1.2.0, and…
Priority LOW 31
Multiple cross-site request forgery (CSRF) vulnerabilities in WebCalendar 1.2.0, and other versions before 1.2.5, allow remote attackers to hijack the authentication of administrators for requests that (1) delete an even…
TI-2011-03371 CVE-2011-3814 · GHSA-cr2c-jcf8-w3xq
WebCalendar 1.2.3, and other versions before 1.2.5, allows remote attackers to obtain…
Priority LOW 25
WebCalendar 1.2.3, and other versions before 1.2.5, allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by…
TI-2012-00781 CVE-2012-0846 · GHSA-rr66-pqp9-7m9f
Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar 1.2.4 allows remote…
Priority LOW 23
Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the Location variable.
TI-2010-00605 CVE-2010-0636 · GHSA-2977-c3c9-wqxf
Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar 1.2.0, and other…
Priority LOW 22
Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar 1.2.0, and other versions before 1.2.5, allow remote attackers to inject arbitrary web script or HTML via the (1) tab parameter to users.php and the PATH…