Read the docs
TI-2004-01382 Aliases CVE-2004-1506GHSA-jgf2-f2cv-9q4x

Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar allow remote attackers…

Priority LOW 23Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar allow remote attackers to inject arbitrary web script via (1) view_entry.php, (2) view_d.php, (3) usersel.php, (4) datesel.php, (5) trailer.php, or (6) styles.php, as demonstrated using img srg tags.

Why it matters now

EPSS 0.01283 70th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 30

CPEVersionsRoleVendor
cpe:2.3:a:webcalendar:webcalendar:0.9.8:*:*:*:*:*:*:*0.9.8VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.11:*:*:*:*:*:*:*0.9.11VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.15:*:*:*:*:*:*:*0.9.15VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.16:*:*:*:*:*:*:*0.9.16VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.19:*:*:*:*:*:*:*0.9.19VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.20:*:*:*:*:*:*:*0.9.20VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.21:*:*:*:*:*:*:*0.9.21VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.22:*:*:*:*:*:*:*0.9.22VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.23:*:*:*:*:*:*:*0.9.23VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.24:*:*:*:*:*:*:*0.9.24VulnerableWebcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.8:*:*:*:*:*:*:* Versions 0.9.8 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.11:*:*:*:*:*:*:* Versions 0.9.11 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.15:*:*:*:*:*:*:* Versions 0.9.15 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.16:*:*:*:*:*:*:* Versions 0.9.16 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.19:*:*:*:*:*:*:* Versions 0.9.19 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.20:*:*:*:*:*:*:* Versions 0.9.20 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.21:*:*:*:*:*:*:* Versions 0.9.21 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.22:*:*:*:*:*:*:* Versions 0.9.22 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.23:*:*:*:*:*:*:* Versions 0.9.23 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.24:*:*:*:*:*:*:* Versions 0.9.24 Vulnerable ·Webcalendar
Show 20 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:webcalendar:webcalendar:0.9.25:*:*:*:*:*:*:*0.9.25VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.26:*:*:*:*:*:*:*0.9.26VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.27:*:*:*:*:*:*:*0.9.27VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.28:*:*:*:*:*:*:*0.9.28VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.29:*:*:*:*:*:*:*0.9.29VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.30:*:*:*:*:*:*:*0.9.30VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.31:*:*:*:*:*:*:*0.9.31VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.32:*:*:*:*:*:*:*0.9.32VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.33:*:*:*:*:*:*:*0.9.33VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.34:*:*:*:*:*:*:*0.9.34VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.35:*:*:*:*:*:*:*0.9.35VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.36:*:*:*:*:*:*:*0.9.36VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.37:*:*:*:*:*:*:*0.9.37VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.38:*:*:*:*:*:*:*0.9.38VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.39:*:*:*:*:*:*:*0.9.39VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.40:*:*:*:*:*:*:*0.9.40VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.41:*:*:*:*:*:*:*0.9.41VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.42:*:*:*:*:*:*:*0.9.42VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.43:*:*:*:*:*:*:*0.9.43VulnerableWebcalendar
cpe:2.3:a:webcalendar:webcalendar:0.9.44:*:*:*:*:*:*:*0.9.44VulnerableWebcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.25:*:*:*:*:*:*:* Versions 0.9.25 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.26:*:*:*:*:*:*:* Versions 0.9.26 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.27:*:*:*:*:*:*:* Versions 0.9.27 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.28:*:*:*:*:*:*:* Versions 0.9.28 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.29:*:*:*:*:*:*:* Versions 0.9.29 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.30:*:*:*:*:*:*:* Versions 0.9.30 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.31:*:*:*:*:*:*:* Versions 0.9.31 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.32:*:*:*:*:*:*:* Versions 0.9.32 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.33:*:*:*:*:*:*:* Versions 0.9.33 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.34:*:*:*:*:*:*:* Versions 0.9.34 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.35:*:*:*:*:*:*:* Versions 0.9.35 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.36:*:*:*:*:*:*:* Versions 0.9.36 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.37:*:*:*:*:*:*:* Versions 0.9.37 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.38:*:*:*:*:*:*:* Versions 0.9.38 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.39:*:*:*:*:*:*:* Versions 0.9.39 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.40:*:*:*:*:*:*:* Versions 0.9.40 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.41:*:*:*:*:*:*:* Versions 0.9.41 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.42:*:*:*:*:*:*:* Versions 0.9.42 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.43:*:*:*:*:*:*:* Versions 0.9.43 Vulnerable ·Webcalendar
  • cpe:2.3:a:webcalendar:webcalendar:0.9.44:*:*:*:*:*:*:* Versions 0.9.44 Vulnerable ·Webcalendar

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2004-1506
  2. 2026-10-03 Alias added: GHSA-jgf2-f2cv-9q4x

References

Other 1

  • TI-2001-00469 Vulnerability in WebCalendar 0.9.26 allows remote command execution. CVSS 2.0HIGH 7.5
  • TI-2007-01288 includes/functions.php in Craig Knudsen WebCalendar before 1.0.5 does not protect the… CVSS 2.0HIGH 7.5
  • TI-2005-03742 Multiple SQL injection vulnerabilities in WebCalendar 1.0.1 allow remote attackers to… CVSS 2.0HIGH 7.5
  • TI-2005-02580 PHP remote file inclusion vulnerability in WebCalendar before 1.0.1 allows remote… CVSS 2.0HIGH 7.5
  • TI-2005-02197 WebCalendar before 1.0.0 does not properly restrict access to assistant_edit.php, which… CVSS 2.0HIGH 7.5
  • TI-2004-01384 init.php in WebCalendar allows remote attackers to execute arbitrary local PHP scripts via the user_inc parameter. CVSS 2.0HIGH 7.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences