CVE-2017-9072

Published: May 18, 2017Modified: May 13, 2026

6.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Two CalendarXP products have XSS in common parts of HTML files. CalendarXP FlatCalendarXP through 9.9.290 has XSS in iflateng.htm and nflateng.htm. CalendarXP PopCalendarXP through 9.8.308 has XSS in ipopeng.htm and npopeng.htm.

Affected (2)

Products: Calendarxp: Flatcalendarxp, Popcalendarxp

Calendarxp

2 products

Flatcalendarxp

Popcalendarxp

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Calendarxp Flatcalendarxp	Up to 9.9.290
Calendarxp Popcalendarxp	Up to 9.8.308

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (6)

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/102632

Source: cve@mitre.org

https://github.com/victorwon/calendarxp/issues/2

Source: cve@mitre.org

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/102632

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/victorwon/calendarxp/issues/2

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.