Read the docs
TI-2013-01240 Aliases CVE-2013-1421GHSA-qmxr-pxhp-w64j

Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar before 1.2.5…

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar before 1.2.5, 1.2.6, and other versions before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the Category Name field to category.php.

Why it matters now

EPSS 0.0124 69th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:webcalendar_project:webcalendar:*:*:*:*:*:*:*:*up to 1.2.4VulnerableWebcalendar Project
cpe:2.3:a:webcalendar_project:webcalendar:1.0:rc1:*:*:*:*:*:*1.0 rc1VulnerableWebcalendar Project
cpe:2.3:a:webcalendar_project:webcalendar:1.0:rc2:*:*:*:*:*:*1.0 rc2VulnerableWebcalendar Project
cpe:2.3:a:webcalendar_project:webcalendar:1.0:rc3:*:*:*:*:*:*1.0 rc3VulnerableWebcalendar Project
cpe:2.3:a:webcalendar_project:webcalendar:1.1.1:*:*:*:*:*:*:*1.1.1VulnerableWebcalendar Project
cpe:2.3:a:webcalendar_project:webcalendar:1.1.2:*:*:*:*:*:*:*1.1.2VulnerableWebcalendar Project
cpe:2.3:a:webcalendar_project:webcalendar:1.1.3:*:*:*:*:*:*:*1.1.3VulnerableWebcalendar Project
cpe:2.3:a:webcalendar_project:webcalendar:1.1.4:*:*:*:*:*:*:*1.1.4VulnerableWebcalendar Project
cpe:2.3:a:webcalendar_project:webcalendar:1.1.5:*:*:*:*:*:*:*1.1.5VulnerableWebcalendar Project
cpe:2.3:a:webcalendar_project:webcalendar:1.1.6:*:*:*:*:*:*:*1.1.6VulnerableWebcalendar Project
  • cpe:2.3:a:webcalendar_project:webcalendar:*:*:*:*:*:*:*:* Versions up to 1.2.4 Vulnerable ·Webcalendar Project
  • cpe:2.3:a:webcalendar_project:webcalendar:1.0:rc1:*:*:*:*:*:* Versions 1.0 rc1 Vulnerable ·Webcalendar Project
  • cpe:2.3:a:webcalendar_project:webcalendar:1.0:rc2:*:*:*:*:*:* Versions 1.0 rc2 Vulnerable ·Webcalendar Project
  • cpe:2.3:a:webcalendar_project:webcalendar:1.0:rc3:*:*:*:*:*:* Versions 1.0 rc3 Vulnerable ·Webcalendar Project
  • cpe:2.3:a:webcalendar_project:webcalendar:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·Webcalendar Project
  • cpe:2.3:a:webcalendar_project:webcalendar:1.1.2:*:*:*:*:*:*:* Versions 1.1.2 Vulnerable ·Webcalendar Project
  • cpe:2.3:a:webcalendar_project:webcalendar:1.1.3:*:*:*:*:*:*:* Versions 1.1.3 Vulnerable ·Webcalendar Project
  • cpe:2.3:a:webcalendar_project:webcalendar:1.1.4:*:*:*:*:*:*:* Versions 1.1.4 Vulnerable ·Webcalendar Project
  • cpe:2.3:a:webcalendar_project:webcalendar:1.1.5:*:*:*:*:*:*:* Versions 1.1.5 Vulnerable ·Webcalendar Project
  • cpe:2.3:a:webcalendar_project:webcalendar:1.1.6:*:*:*:*:*:*:* Versions 1.1.6 Vulnerable ·Webcalendar Project
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:webcalendar_project:webcalendar:1.2:b1:*:*:*:*:*:*1.2 b1VulnerableWebcalendar Project
cpe:2.3:a:webcalendar_project:webcalendar:1.2.0:*:*:*:*:*:*:*1.2.0VulnerableWebcalendar Project
cpe:2.3:a:webcalendar_project:webcalendar:1.2.1:*:*:*:*:*:*:*1.2.1VulnerableWebcalendar Project
cpe:2.3:a:webcalendar_project:webcalendar:1.2.2:*:*:*:*:*:*:*1.2.2VulnerableWebcalendar Project
cpe:2.3:a:webcalendar_project:webcalendar:1.2.3:*:*:*:*:*:*:*1.2.3VulnerableWebcalendar Project
cpe:2.3:a:webcalendar_project:webcalendar:1.2.6:*:*:*:*:*:*:*1.2.6VulnerableWebcalendar Project
  • cpe:2.3:a:webcalendar_project:webcalendar:1.2:b1:*:*:*:*:*:* Versions 1.2 b1 Vulnerable ·Webcalendar Project
  • cpe:2.3:a:webcalendar_project:webcalendar:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·Webcalendar Project
  • cpe:2.3:a:webcalendar_project:webcalendar:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·Webcalendar Project
  • cpe:2.3:a:webcalendar_project:webcalendar:1.2.2:*:*:*:*:*:*:* Versions 1.2.2 Vulnerable ·Webcalendar Project
  • cpe:2.3:a:webcalendar_project:webcalendar:1.2.3:*:*:*:*:*:*:* Versions 1.2.3 Vulnerable ·Webcalendar Project
  • cpe:2.3:a:webcalendar_project:webcalendar:1.2.6:*:*:*:*:*:*:* Versions 1.2.6 Vulnerable ·Webcalendar Project

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-1421
  2. 2026-10-03 Alias added: GHSA-qmxr-pxhp-w64j

References

Exploit 1

Patch 1

Other 1

  • TI-2012-01308 install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute… CVSS 3.1CRITICAL 9.8
  • TI-2024-15086 WebCalendar v1.3.0 was discovered to contain a reflected cross-site scripting (XSS)… CVSS 3.1MEDIUM 6.1
  • TI-2023-00274 Cross-site Scripting (XSS) - Stored in craigk5n/webcalendar CVSS 3.1MEDIUM 5.4
  • TI-2012-01309 Local file inclusion in WebCalendar before 1.2.5. CVSS 3.1HIGH 8.8
  • TI-2012-04558 install/index.php in Craig Knudsen WebCalendar before 1.2.5 allows remote attackers to… CVSS 2.0HIGH 7.5
  • TI-2017-07941 Cross-site scripting in k5n.us WebCalendar CVSS 3.0MEDIUM 6.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences