CVE-2007-6365: XSS
Cross-site scripting (XSS) vulnerability in modules/ecal/display.php in the Event Calendar in bcoos 1.0.10 allows remote attackers to inject arbitrary web script or HTML via the month parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: the day and year vectors are covered by CVE-2007-6274.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-6365?
The severity of CVE-2007-6365 is classified as Medium due to its potential for cross-site scripting attacks.
How do I fix CVE-2007-6365?
To fix CVE-2007-6365, consider filtering and sanitizing user input in the month parameter to prevent script injection.
What systems are affected by CVE-2007-6365?
CVE-2007-6365 affects Event Calendar version 1.0.10 of the Bcoos software.
Can CVE-2007-6365 lead to data theft?
Yes, CVE-2007-6365 can lead to data theft as it allows attackers to execute arbitrary scripts in the context of the user’s browser.
Is CVE-2007-6365 easy to exploit?
Yes, CVE-2007-6365 is relatively easy to exploit, as it requires only manipulation of the URL to inject malicious scripts.