WebCalendar v1.3.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /WebCalendarvqsmnseug2/edit_entry.php.
CVSS
6.1
MEDIUM
Published
Jan 25, 2024
Loading
Vendor coverage
Track published CVEs, severity trends, and remediation context for webcalendar_project products.
Search results
Showing 1-10 of 10 vulnerabilities.
WebCalendar v1.3.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /WebCalendarvqsmnseug2/edit_entry.php.
CVSS
6.1
MEDIUM
Published
Jan 25, 2024
Cross-site Scripting (XSS) - Stored in GitHub repository craigk5n/webcalendar prior to master.
CVSS
5.4
MEDIUM
Published
Jan 13, 2023
webcalendar before 1.2.7 shows the reason for a failed login (e.g., "no such user").
CVSS
5.3
MEDIUM
Published
Feb 4, 2020
Local file inclusion in WebCalendar before 1.2.5.
CVSS
8.8
HIGH
Published
Jan 27, 2020
install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form_single_user_login parameter.
CVSS
9.8
CRITICAL
Published
Jan 27, 2020
Directory traversal vulnerability in WebCalendar 1.2.7 and earlier allows authenticated attackers to read arbitrary files via unspecified vectors.
CVSS
4.9
MEDIUM
Published
Aug 29, 2017
Cross-site scripting vulnerability in WebCalendar 1.2.7 and earlier allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
CVSS
6.1
MEDIUM
Published
Aug 29, 2017
Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar before 1.2.5, 1.2.6, and other versions before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the Category Name field to category.php.
CVSS
4.3
UNKNOWN
Published
Apr 22, 2014
install/index.php in Craig Knudsen WebCalendar before 1.2.5 allows remote attackers to modify settings.php and possibly execute arbitrary code via vectors related to the user theme preference.
CVSS
7.5
UNKNOWN
Published
Oct 11, 2012
Multiple cross-site scripting (XSS) vulnerabilities in Craig Knudsen WebCalendar allow remote attackers to inject arbitrary web script or HTML via the (1) $name or (2) $description variables in edit_entry_handler.php, or (3) $url, (4) $tempfullname, or (5) $ext_users[] variables in view_entry.php, different vectors than CVE-2012-0846.
CVSS
4.3
UNKNOWN
Published
Oct 11, 2012