$ cve CVE-2007-1111 JSON

CVE-2007-1111 EXPLOIT

6.8

MEDIUM · CVSS 2.0 · EPSS 6.1% (pctl 93)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in ActiveCalendar 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the css parameter to (1) flatevents.php, (2) js.php, (3) mysqlevents.php, (4) m_2.php, (5) m_3.php, (6) m_4.php, (7) xmlevents.php, (8) y_2.php, or (9) y_3.php in data/.

Scoring

CVSS	6.8 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS	6.09% — more likely to be exploited than 93% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2007-02-26
Last modified	2026-06-16

Affected (1)

Vendor	Product
activecalendar	activecalendar

Public exploits

Source	Title	Date
exploit-db	Active Calendar 1.2 - '/data/flatevents.php?css' Cross-Site Scripting	2007-02-24
exploit-db	Active Calendar 1.2 - '/data/js.php?css' Cross-Site Scripting	2007-02-24
exploit-db	Active Calendar 1.2 - '/data/m_2.php?css' Cross-Site Scripting	2007-02-24
exploit-db	Active Calendar 1.2 - '/data/m_3.php?css' Cross-Site Scripting	2007-02-24
exploit-db	Active Calendar 1.2 - '/data/m_4.php?css' Cross-Site Scripting	2007-02-24
exploit-db	Active Calendar 1.2 - '/data/y_2.php?css' Cross-Site Scripting	2007-02-24
exploit-db	Active Calendar 1.2 - '/data/y_3.php?css' Cross-Site Scripting	2007-02-24
exploit-db	Active Calendar 1.2 - '/data/mysqlevents.php?css' Cross-Site Scripting	2007-02-24

References

→ the Explorer · watch your stack · NVD