TI-2024-01017 Aliases CVE-2024-1097 GHSA-8j99-75gr-3jf5

Stored XSS in craigk5n/webcalendar

MEDIUM 58CWE-79Published 2024-11-15 · Updated 2024-11-15

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

A stored cross-site scripting (XSS) vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report, potentially leading to the theft of user accounts and cookies.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00341 27th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
craigk5n	craigk5n/webcalendar	up to latest	—	No fix listed	CNA

craigk5n/webcalendar Vendorcraigk5n Affected up to latest Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:k5n:webcalendar:1.3.0:::::::*	1.3.0	Vulnerable	K5n

cpe:2.3:a:k5n:webcalendar:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·K5n

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-1097
2026-10-03 Alias added: GHSA-8j99-75gr-3jf5

References

Exploit 1

https://huntr.com/bounties/6dd501f6-6047-4ddb-8b14-f0fc53cdc28e

TI-2007-01425 Multiple PHP remote file inclusion vulnerabilities in WebCalendar 0.9.45 allow remote… CVSS 2.0HIGH 7.5
TI-2008-02710 PHP remote file inclusion vulnerability in send_reminders.php in WebCalendar 1.0.4 allows… CVSS 2.0HIGH 7.5
TI-2010-00607 Cross-site request forgery (CSRF) vulnerability in WebCalendar 1.2.0 allows remote… CVSS 2.0MEDIUM 6.8
TI-2010-00606 Multiple cross-site request forgery (CSRF) vulnerabilities in WebCalendar 1.2.0, and… CVSS 2.0MEDIUM 6.8
TI-2011-03371 WebCalendar 1.2.3, and other versions before 1.2.5, allows remote attackers to obtain… CVSS 2.0MEDIUM 5.0
TI-2012-00781 Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar 1.2.4 allows remote… CVSS 2.0MEDIUM 4.3

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences