CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2006-6824

Multiple cross-site scripting (XSS) vulnerabilities in Jim Hu and Chad Little PHP iCalendar 2.23 rc1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) getdate parameter in (a) day.php, (b) month.php, (c) year.php, (d) week.php, (e) search.php, (f) rss/index.php, (g) print.php, and (h) preferences.php; the (2) cpath parameter in (i) day.php, (j) month.php, (k) year.php, (l) week.php, and (m) search.php; the (3) query parameter in search.php; and possibly the cpath, (4) unset, and (5) set parameters in a setcookie action in preferences.php; different vectors than CVE-2006-3319. NOTE: it was later reported that vectors b, c, and d also affect 2.24.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.02

EPSS Ranking 82.9%

CVSS Severity

CVSS v2 Score 4.3

References

Products affected by CVE-2006-6824

Php Icalendar » Php Icalendar » Version: Any

cpe:2.3:a:php_icalendar:php_icalendar:*
Php Icalendar » Php Icalendar » Version: 1.1

cpe:2.3:a:php_icalendar:php_icalendar:1.1
Php Icalendar » Php Icalendar » Version: 2.22

cpe:2.3:a:php_icalendar:php_icalendar:2.22
Php Icalendar » Php Icalendar » Version: 2.24

cpe:2.3:a:php_icalendar:php_icalendar:2.24
Php Icalendar » Php Icalendar » Version: 2.2_beta

cpe:2.3:a:php_icalendar:php_icalendar:2.2_beta

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2006-6824

Products

Pricing

Contact Us