CVE-2006-0657 Cross-site scripting (XSS) vulnerability in Softcomplex PHP Event Calendar 1.5 allows remote authenticated users to inject arbitrary web script or HTML, and corrupt data, via the (1) username and (2)....
LowCVSS 3.5
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in Softcomplex PHP Event Calendar 1.5 allows remote authenticated users to inject arbitrary web script or HTML, and corrupt data, via the (1) username and (2) password parameters, which are not sanitized before being written to users.php. NOTE: while this issue was originally reported as XSS, the primary issue might be direct static code injection with resultant XSS.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| softcomplex php event calendar | = 1.5 | No fix listed |
References
- evuln.com vendor-advisory
- 18792 third-party-advisory vendor-advisory
- 442 third-party-advisory
- 23071 vdb-entry
- 23072 vdb-entry
- 16588 vdb-entry
- ADV-2006-0507 vdb-entry
- phpeventcalendar-users-xss(24523) vdb-entry