CVE-2010-0636

NONE

Published Feb 12, 201016y ago · Modified Jun 16, 20262w ago

Published Feb 12, 2010 16y ago

Last Modified Jun 16, 2026 2w ago

Description

Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar 1.2.0, and other versions before 1.2.5, allow remote attackers to inject arbitrary web script or HTML via the (1) tab parameter to users.php and the PATH_INFO to (2) day.php, (3) month.php, and (4) week.php. NOTE: some of these details are obtained from third party information.

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

Vendor	Product	Version	Range
k5n	webcalendar	1.2.0	any

References 4

holisticinfosec.org http://holisticinfosec.org/content/view/133/45/
secunia.com http://secunia.com/advisories/38222

Vendor Advisory
webcalendar.cvs.sourceforge.net http://webcalendar.cvs.sourceforge.net/viewvc/webcalendar/webcalendar/ChangeLog?pathrev=REL_1_2
securityfocus.com http://www.securityfocus.com/bid/38053

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.