Vendors / Webcalendar Project Records 10 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 2
Exploited now Webcalendar Project records in CISA KEV No Webcalendar Project vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 82
install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form_single_user_login parameter.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.79764 · Published 2020-01-27 · No fix listed CWE-74
Priority MEDIUM 60
WebCalendar v1.3.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /WebCalendarvqsmnseug2/edit_entry.php.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00459 · Published 2024-01-25 · No fix listed CWE-79
Priority MEDIUM 58
Cross-site Scripting (XSS) - Stored in GitHub repository craigk5n/webcalendar prior to master.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00541 · Published 2023-01-13 · Fixed in master CWE-79
Priority MEDIUM 43
Local file inclusion in WebCalendar before 1.2.5.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02531 · Published 2020-01-27 · No fix listed CWE-74
Priority LOW 37
install/index.php in Craig Knudsen WebCalendar before 1.2.5 allows remote attackers to modify settings.php and possibly execute arbitrary code via vectors related to the user theme preference.
CVSS 2.0 HIGH 7.5· Network · No auth · Interaction — · EPSS 0.02173 · Published 2012-10-11 · No fix listed CWE-264
Priority LOW 29
Cross-site scripting vulnerability in WebCalendar 1.2.7 and earlier allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
CVSS 3.0 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00934 · Published 2017-08-28 · No fix listed CWE-79
Priority LOW 27
Directory traversal vulnerability in WebCalendar 1.2.7 and earlier allows authenticated attackers to read arbitrary files via unspecified vectors.
CVSS 3.0 MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.02353 · Published 2017-08-28 · No fix listed CWE-22
Priority LOW 27
webcalendar before 1.2.7 shows the reason for a failed login (e.g., "no such user").
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01621 · Published 2020-02-04 · No fix listed CWE-203
Priority LOW 23
Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar before 1.2.5, 1.2.6, and other versions before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the Category Name field to cat…
CVSS 2.0 MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.0124 · Published 2014-04-22 · No fix listed CWE-79
Priority LOW 22
Multiple cross-site scripting (XSS) vulnerabilities in Craig Knudsen WebCalendar allow remote attackers to inject arbitrary web script or HTML via the (1) $name or (2) $description variables in edit_entry_handler.php, or…
CVSS 2.0 MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.00931 · Published 2012-10-11 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
1 2 7 0 0
THREATIST.IORead the docs