CVE-2007-6696 Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar 1.1.6 allow remote attackers to inject arbitrary web script or HTML via (1) an event description, (2) the query string to pref.php, a...
LowCVSS 2.1
EPSS 1.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar 1.1.6 allow remote attackers to inject arbitrary web script or HTML via (1) an event description, (2) the query string to pref.php, and (3) the adv parameter to search.php. NOTE: vector 1 requires user authentication.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| webcalendar | = 1.1.6 | No fix listed |
References
- 41274 vdb-entry
- 41275 vdb-entry
- 41276 vdb-entry
- www.digitrustgroup.com exploit
- 27461 exploit vdb-entry