Webcalendar Project

webcalendar_project

10 CVEs • 1 product

Products (1)

Click to collapse

Toggle

CVEs (10)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-22635 1Webcalendar Project 1Webcalendar Jun 17, 2026 Jan 25, 2024 N/A· v4 6.1 MEDIUM· v3 N/A· v2 WebCalendar v1.3.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /WebCalendarvqsmnseug2/edit_entry.php.
CVE-2023-0289 1Webcalendar Project 1Webcalendar Jun 17, 2026 Jan 13, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross-site Scripting (XSS) - Stored in GitHub repository craigk5n/webcalendar prior to master.
CVE-2013-1422 1Webcalendar Project 1Webcalendar Nov 21, 2024 Feb 4, 2020 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 webcalendar before 1.2.7 shows the reason for a failed login (e.g., "no such user").
CVE-2012-1496 1Webcalendar Project 1Webcalendar Nov 21, 2024 Jan 27, 2020 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Local file inclusion in WebCalendar before 1.2.5.
CVE-2012-1495 1Webcalendar Project 1Webcalendar Nov 21, 2024 Jan 27, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form_single_user_login parameter.
CVE-2017-10841 1Webcalendar Project 1Webcalendar May 13, 2026 Aug 29, 2017 N/A· v4 4.9 MEDIUM· v3 4.0 MEDIUM· v2 Directory traversal vulnerability in WebCalendar 1.2.7 and earlier allows authenticated attackers to read arbitrary files via unspecified vectors.
CVE-2017-10840 1Webcalendar Project 1Webcalendar May 13, 2026 Aug 29, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in WebCalendar 1.2.7 and earlier allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
CVE-2013-1421 1Webcalendar Project 1Webcalendar May 6, 2026 Apr 22, 2014 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar before 1.2.5, 1.2.6, and other versions before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the Category Name field to cat...Show more Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar before 1.2.5, 1.2.6, and other versions before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the Category Name field to category.php.Show less
CVE-2012-5385 1Webcalendar Project 1Webcalendar Apr 29, 2026 Oct 11, 2012 N/A· v4 N/A· v3 7.5 HIGH· v2 install/index.php in Craig Knudsen WebCalendar before 1.2.5 allows remote attackers to modify settings.php and possibly execute arbitrary code via vectors related to the user theme preference.
CVE-2012-5384 1Webcalendar Project 1Webcalendar Apr 29, 2026 Oct 11, 2012 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in Craig Knudsen WebCalendar allow remote attackers to inject arbitrary web script or HTML via the (1) $name or (2) $description variables in edit_entry_handler.php, or...Show more Multiple cross-site scripting (XSS) vulnerabilities in Craig Knudsen WebCalendar allow remote attackers to inject arbitrary web script or HTML via the (1) $name or (2) $description variables in edit_entry_handler.php, or (3) $url, (4) $tempfullname, or (5) $ext_users[] variables in view_entry.php, different vectors than CVE-2012-0846.Show less