Cross-site scripting (XSS) vulnerability in the Calendar Base (cal) extension before…
Priority LOW 22CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
Cross-site scripting (XSS) vulnerability in the Calendar Base (cal) extension before 1.1.1 for TYPO3, when Internet Explorer 6 is used, allows remote attackers to inject arbitrary web script or HTML via "search parameters."
Why it matters now
EPSS 0.01033 64th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 30
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mario_matzulla:calendar_base:*:*:*:*:*:*:*:* | up to 1.1.0 | Vulnerable | Mario Matzulla |
| cpe:2.3:a:mario_matzulla:calendar_base:0.9.0:*:*:*:*:*:*:* | 0.9.0 | Vulnerable | Mario Matzulla |
| cpe:2.3:a:mario_matzulla:calendar_base:0.10.0:*:*:*:*:*:*:* | 0.10.0 | Vulnerable | Mario Matzulla |
| cpe:2.3:a:mario_matzulla:calendar_base:0.11.0:*:*:*:*:*:*:* | 0.11.0 | Vulnerable | Mario Matzulla |
| cpe:2.3:a:mario_matzulla:calendar_base:0.12.0:*:*:*:*:*:*:* | 0.12.0 | Vulnerable | Mario Matzulla |
| cpe:2.3:a:mario_matzulla:calendar_base:0.12.1:*:*:*:*:*:*:* | 0.12.1 | Vulnerable | Mario Matzulla |
| cpe:2.3:a:mario_matzulla:calendar_base:0.13.0:*:*:*:*:*:*:* | 0.13.0 | Vulnerable | Mario Matzulla |
| cpe:2.3:a:mario_matzulla:calendar_base:0.13.1:*:*:*:*:*:*:* | 0.13.1 | Vulnerable | Mario Matzulla |
| cpe:2.3:a:mario_matzulla:calendar_base:0.14.0:*:*:*:*:*:*:* | 0.14.0 | Vulnerable | Mario Matzulla |
| cpe:2.3:a:mario_matzulla:calendar_base:0.14.1:*:*:*:*:*:*:* | 0.14.1 | Vulnerable | Mario Matzulla |
- cpe:2.3:a:mario_matzulla:calendar_base:*:*:*:*:*:*:*:* Versions up to 1.1.0 Vulnerable ·Mario Matzulla
- cpe:2.3:a:mario_matzulla:calendar_base:0.9.0:*:*:*:*:*:*:* Versions 0.9.0 Vulnerable ·Mario Matzulla
- cpe:2.3:a:mario_matzulla:calendar_base:0.10.0:*:*:*:*:*:*:* Versions 0.10.0 Vulnerable ·Mario Matzulla
- cpe:2.3:a:mario_matzulla:calendar_base:0.11.0:*:*:*:*:*:*:* Versions 0.11.0 Vulnerable ·Mario Matzulla
- cpe:2.3:a:mario_matzulla:calendar_base:0.12.0:*:*:*:*:*:*:* Versions 0.12.0 Vulnerable ·Mario Matzulla
- cpe:2.3:a:mario_matzulla:calendar_base:0.12.1:*:*:*:*:*:*:* Versions 0.12.1 Vulnerable ·Mario Matzulla
- cpe:2.3:a:mario_matzulla:calendar_base:0.13.0:*:*:*:*:*:*:* Versions 0.13.0 Vulnerable ·Mario Matzulla
- cpe:2.3:a:mario_matzulla:calendar_base:0.13.1:*:*:*:*:*:*:* Versions 0.13.1 Vulnerable ·Mario Matzulla
- cpe:2.3:a:mario_matzulla:calendar_base:0.14.0:*:*:*:*:*:*:* Versions 0.14.0 Vulnerable ·Mario Matzulla
- cpe:2.3:a:mario_matzulla:calendar_base:0.14.1:*:*:*:*:*:*:* Versions 0.14.1 Vulnerable ·Mario Matzulla
Show 20 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mario_matzulla:calendar_base:0.15.0:*:*:*:*:*:*:* | 0.15.0 | Vulnerable | Mario Matzulla |
| cpe:2.3:a:mario_matzulla:calendar_base:0.15.1:*:*:*:*:*:*:* | 0.15.1 | Vulnerable | Mario Matzulla |
| cpe:2.3:a:mario_matzulla:calendar_base:0.15.2:*:*:*:*:*:*:* | 0.15.2 | Vulnerable | Mario Matzulla |
| cpe:2.3:a:mario_matzulla:calendar_base:0.15.3:*:*:*:*:*:*:* | 0.15.3 | Vulnerable | Mario Matzulla |
| cpe:2.3:a:mario_matzulla:calendar_base:0.15.4:*:*:*:*:*:*:* | 0.15.4 | Vulnerable | Mario Matzulla |
| cpe:2.3:a:mario_matzulla:calendar_base:0.15.5:*:*:*:*:*:*:* | 0.15.5 | Vulnerable | Mario Matzulla |
| cpe:2.3:a:mario_matzulla:calendar_base:0.16.0:*:*:*:*:*:*:* | 0.16.0 | Vulnerable | Mario Matzulla |
| cpe:2.3:a:mario_matzulla:calendar_base:0.16.1:*:*:*:*:*:*:* | 0.16.1 | Vulnerable | Mario Matzulla |
| cpe:2.3:a:mario_matzulla:calendar_base:0.16.2:*:*:*:*:*:*:* | 0.16.2 | Vulnerable | Mario Matzulla |
| cpe:2.3:a:mario_matzulla:calendar_base:0.16.3:*:*:*:*:*:*:* | 0.16.3 | Vulnerable | Mario Matzulla |
| cpe:2.3:a:mario_matzulla:calendar_base:0.16.4:*:*:*:*:*:*:* | 0.16.4 | Vulnerable | Mario Matzulla |
| cpe:2.3:a:mario_matzulla:calendar_base:0.16.5:*:*:*:*:*:*:* | 0.16.5 | Vulnerable | Mario Matzulla |
| cpe:2.3:a:mario_matzulla:calendar_base:0.16.6:*:*:*:*:*:*:* | 0.16.6 | Vulnerable | Mario Matzulla |
| cpe:2.3:a:mario_matzulla:calendar_base:0.17.0:*:*:*:*:*:*:* | 0.17.0 | Vulnerable | Mario Matzulla |
| cpe:2.3:a:mario_matzulla:calendar_base:0.17.1:*:*:*:*:*:*:* | 0.17.1 | Vulnerable | Mario Matzulla |
| cpe:2.3:a:mario_matzulla:calendar_base:0.17.2:*:*:*:*:*:*:* | 0.17.2 | Vulnerable | Mario Matzulla |
| cpe:2.3:a:mario_matzulla:calendar_base:0.17.3:*:*:*:*:*:*:* | 0.17.3 | Vulnerable | Mario Matzulla |
| cpe:2.3:a:mario_matzulla:calendar_base:1.0.0:*:*:*:*:*:*:* | 1.0.0 | Vulnerable | Mario Matzulla |
| cpe:2.3:a:microsoft:internet_explorer:*:*:*:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:* | all versions | Running on | TYPO3 |
- cpe:2.3:a:mario_matzulla:calendar_base:0.15.0:*:*:*:*:*:*:* Versions 0.15.0 Vulnerable ·Mario Matzulla
- cpe:2.3:a:mario_matzulla:calendar_base:0.15.1:*:*:*:*:*:*:* Versions 0.15.1 Vulnerable ·Mario Matzulla
- cpe:2.3:a:mario_matzulla:calendar_base:0.15.2:*:*:*:*:*:*:* Versions 0.15.2 Vulnerable ·Mario Matzulla
- cpe:2.3:a:mario_matzulla:calendar_base:0.15.3:*:*:*:*:*:*:* Versions 0.15.3 Vulnerable ·Mario Matzulla
- cpe:2.3:a:mario_matzulla:calendar_base:0.15.4:*:*:*:*:*:*:* Versions 0.15.4 Vulnerable ·Mario Matzulla
- cpe:2.3:a:mario_matzulla:calendar_base:0.15.5:*:*:*:*:*:*:* Versions 0.15.5 Vulnerable ·Mario Matzulla
- cpe:2.3:a:mario_matzulla:calendar_base:0.16.0:*:*:*:*:*:*:* Versions 0.16.0 Vulnerable ·Mario Matzulla
- cpe:2.3:a:mario_matzulla:calendar_base:0.16.1:*:*:*:*:*:*:* Versions 0.16.1 Vulnerable ·Mario Matzulla
- cpe:2.3:a:mario_matzulla:calendar_base:0.16.2:*:*:*:*:*:*:* Versions 0.16.2 Vulnerable ·Mario Matzulla
- cpe:2.3:a:mario_matzulla:calendar_base:0.16.3:*:*:*:*:*:*:* Versions 0.16.3 Vulnerable ·Mario Matzulla
- cpe:2.3:a:mario_matzulla:calendar_base:0.16.4:*:*:*:*:*:*:* Versions 0.16.4 Vulnerable ·Mario Matzulla
- cpe:2.3:a:mario_matzulla:calendar_base:0.16.5:*:*:*:*:*:*:* Versions 0.16.5 Vulnerable ·Mario Matzulla
- cpe:2.3:a:mario_matzulla:calendar_base:0.16.6:*:*:*:*:*:*:* Versions 0.16.6 Vulnerable ·Mario Matzulla
- cpe:2.3:a:mario_matzulla:calendar_base:0.17.0:*:*:*:*:*:*:* Versions 0.17.0 Vulnerable ·Mario Matzulla
- cpe:2.3:a:mario_matzulla:calendar_base:0.17.1:*:*:*:*:*:*:* Versions 0.17.1 Vulnerable ·Mario Matzulla
- cpe:2.3:a:mario_matzulla:calendar_base:0.17.2:*:*:*:*:*:*:* Versions 0.17.2 Vulnerable ·Mario Matzulla
- cpe:2.3:a:mario_matzulla:calendar_base:0.17.3:*:*:*:*:*:*:* Versions 0.17.3 Vulnerable ·Mario Matzulla
- cpe:2.3:a:mario_matzulla:calendar_base:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Mario Matzulla
- cpe:2.3:a:microsoft:internet_explorer:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:* Versions all versions Running on ·TYPO3
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2009-4804
- 2026-10-03 Alias added: GHSA-pj5p-vp8q-c483
References
Sources
- CVE-2009-4804 · CVE Program
- CVE-2009-4804 · NVD
- FIRST EPSS
- GHSA-pj5p-vp8q-c483 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences