CVE-2008-3849 Cross-site scripting (XSS) vulnerability in the calendar controller in Civic Website Manager before 1.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probab...
MediumCVSS 4.3
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in the calendar controller in Civic Website Manager before 1.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably involving (1) month, (2) day, and (3) year fields.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| civic-cms | <= 1.0 | No fix listed |
References
- 31609 patch third-party-advisory vendor-advisory
- 31641 third-party-advisory
- sourceforge.net
- 30833 patch vdb-entry
- civic-website-calendar-xss(44673) vdb-entry