medium6.8Public exploit code

CVE-2007-1111

Multiple cross-site scripting (XSS) vulnerabilities in ActiveCalendar 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the css parameter…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Active Calendar 1.2 - '/data/mysqlevents.php?css' Cross-Site Scripting2007-02-24 · webapps · php · Verified
Active Calendar 1.2 - '/data/y_3.php?css' Cross-Site Scripting2007-02-24 · webapps · php · Verified
Active Calendar 1.2 - '/data/y_2.php?css' Cross-Site Scripting2007-02-24 · webapps · php · Verified
Active Calendar 1.2 - '/data/m_4.php?css' Cross-Site Scripting2007-02-24 · webapps · php · Verified
Active Calendar 1.2 - '/data/m_3.php?css' Cross-Site Scripting2007-02-24 · webapps · php · Verified
Active Calendar 1.2 - '/data/m_2.php?css' Cross-Site Scripting2007-02-24 · webapps · php · Verified
Active Calendar 1.2 - '/data/js.php?css' Cross-Site Scripting2007-02-24 · webapps · php · Verified
Active Calendar 1.2 - '/data/flatevents.php?css' Cross-Site Scripting2007-02-24 · webapps · php · Verified

Impact

Multiple cross-site scripting (XSS) vulnerabilities in ActiveCalendar 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the css parameter to (1) flatevents.php, (2) js.php, (3) mysqlevents.php, (4) m_2.php, (5) m_3.php, (6) m_4.php, (7) xmlevents.php, (8) y_2.php, or (9) y_3.php in data/.

Affected products

Vendor	Product	Affected versions
Activecalendar	Activecalendar	Version 1.2.0

Public exploit code

Impact

Affected products

References