CVE-2021-42078

Published: Nov 8, 2021Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

PHP Event Calendar through 2021-11-04 allows persistent cross-site scripting (XSS), as demonstrated by the /server/ajax/events_manager.php title parameter. This can be exploited by an adversary in multiple ways, e.g., to perform actions on the page in the context of other users, or to deface the site.

Affected (1)

Products: Php Event Calendar Project: Php Event Calendar

Php Event Calendar Project

1 product

Php Event Calendar

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Php Event Calendar Project Php Event Calendar	Version 2021-11-04

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

http://seclists.org/fulldisclosure/2021/Nov/24

Source: cve@mitre.org

ExploitMailing ListThird Party Advisory

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-049.txt

Source: cve@mitre.org

ExploitThird Party Advisory

http://seclists.org/fulldisclosure/2021/Nov/24

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMailing ListThird Party Advisory

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-049.txt

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.