Webcalendar Project

10 CVEs across 1 Webcalendar Project products. Browse Webcalendar Project vulnerabilities, severities, and proof-of-concept exploits.

Webcalendar Project products with known CVEs

ProductCVEs
Webcalendar10
Webcalendar Project CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2024-22635Medium6.12024-01-25WebCalendar v1.3.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /WebCalendarvqsmnseug2/edit_entry.php.
CVE-2023-0289Medium5.42023-01-13Cross-site Scripting (XSS) - Stored in GitHub repository craigk5n/webcalendar prior to master.
CVE-2013-1422Medium5.32020-02-04webcalendar before 1.2.7 shows the reason for a failed login (e.g., "no such user").
CVE-2012-1496High8.82020-01-27Local file inclusion in WebCalendar before 1.2.5.
CVE-2012-1495Critical9.82020-01-27install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form_single_user_login parameter.
CVE-2017-10841Medium4.92017-08-29Directory traversal vulnerability in WebCalendar 1.2.7 and earlier allows authenticated attackers to read arbitrary files via unspecified vectors.
CVE-2017-10840Medium6.12017-08-29Cross-site scripting vulnerability in WebCalendar 1.2.7 and earlier allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
CVE-2013-14212014-04-22Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar before 1.2.5, 1.2.6, and other versions before 1.2.7 allows remote attackers to inject ar…
CVE-2012-53852012-10-11install/index.php in Craig Knudsen WebCalendar before 1.2.5 allows remote attackers to modify settings.php and possibly execute arbitrary code via vectors rela…
CVE-2012-53842012-10-11Multiple cross-site scripting (XSS) vulnerabilities in Craig Knudsen WebCalendar allow remote attackers to inject arbitrary web script or HTML via the (1) $nam…