CVE-2021-42078
MEDIUM 6.1EPSS 0.9%
PHP Event Calendar through 2021-11-04 allows persistent cross-site scripting (XSS), as demonstrated by the /server/ajax/events_manager.php title parameter. This can be exploited by an adversary in multiple ways, e.g., to perform actions on the page in the context of other users, or to deface the site.
- CVSS v3.1 NVD
- 6.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS v2.0 NVD
- 4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N - EPSS
- 0.89% chance of exploitation in the next 30 days, 59th percentile
- Published
- 2021-11-08
- Updated
- 2024-08-04
Proof-of-concept exploits (2)
- http://seclists.org/fulldisclosure/2021/Nov/24
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-049.txt