CVE-2024-1097

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-1097

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-1097.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-1097

Published

2024-11-15T10:57:11Z

Modified

2026-10-28T02:30:55Z

Severity

7.6 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H CVSS Calculator

Summary

Stored XSS in craigk5n/webcalendar

Details

A stored cross-site scripting (XSS) vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report, potentially leading to the theft of user accounts and cookies.

Database specific

{
    "cna_assigner":  "@huntr_ai",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/1xxx/CVE-2024-1097.json"
}

References

Affected packages

Git / github.com/craigk5n/webcalendar

Affected ranges

Type

GIT

Repo

https://github.com/craigk5n/webcalendar

Events

Introduced

667bfb32c9f1865b72c7082762e120bf4cf9a2fa

Last Affected

667bfb32c9f1865b72c7082762e120bf4cf9a2fa

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:k5n:webcalendar:1.3.0:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.3.0"
                },
                {
                    "last_affected":  "1.3.0"
                }
            ],
            "source":  "CPE_STRING"
        }
    ]
}

Affected versions

1.*

1.3.0

v1.*

v1.3.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-1097.json"