Description
Multiple cross-site scripting (XSS) vulnerabilities in index.php in PHP-Calendar before 2.0 Beta7 allow remote attackers to inject arbitrary web script or HTML via the (1) description and (2) lastaction parameters.
References
- phpcalendar-description-xss(58861) vdb-entry
- ADV-2010-1202 vdb-entry
- 20100521 PHP-Calendar "description" and "lastaction" Cross Site Scripting Vulnerabilities mailing-list
- 40334 vdb-entry
- http://packetstormsecurity.org/1005-advisories/phpcalendar-xss.txt
- 33899 third-party-advisory
- http://php-calendar.blogspot.com/2010/05/php-calendar-20-beta7.html