CVE-2024-1097CWE-79

Stored XSS in craigk5n/webcalendar

High · published November 15, 2024

CVSS v3.0
7.6
EPSS
0%
Percentile
24.5
In the wild
Unconfirmed
What it is

A stored cross-site scripting (XSS) vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report, potentially leading to the theft of user accounts and cookies.

The record
Technical detail
CVSS v3.0
7.6 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00327 · 24.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-11-15T10:57Z
EPSS history
Timeline
  • 15 NOV 10:57Z
    Stored XSS in craigk5n/webcalendar
    cvelistv5