« Back to list

CVE-2013-1421

Status: ModifiedMedium (4.3)—

Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar before 1.2.5, 1.2.6, and other versions before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the Category Name field to category.php.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Webcalendar Project — Webcalendar

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2013-1421",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-04-22T14:23:31.753",
  "references": [
    {
      "url": "http://osvdb.org/90669",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securitymaverick.com/vulnerability-cve-2013-1421-webcalendar-1-2-5-1-2-6-category-name-persistent-xss/",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://sourceforge.net/projects/webcalendar/files/webcalendar%201.2/1.2.7/",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/90669",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securitymaverick.com/vulnerability-cve-2013-1421-webcalendar-1-2-5-1-2-6-category-name-persistent-xss/",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://sourceforge.net/projects/webcalendar/files/webcalendar%201.2/1.2.7/",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar before 1.2.5, 1.2.6, and other versions before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the Category Name field to category.php."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de XSS en Craig Knudsen WebCalendar anterior a 1.2.5, 1.2.6 y otros versiones anteriores a 1.2.7 permite a atacantes remotos inyectar script Web o HTML arbitrarios a través del campo Category Name hacia category.php."
    }
  ],
  "lastModified": "2026-06-16T23:51:24.313",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:webcalendar_project:webcalendar:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "843C5AA0-7B4A-4524-81F5-3BF648DA5F8F",
              "versionEndIncluding": "1.2.4"
            },
            {
              "criteria": "cpe:2.3:a:webcalendar_project:webcalendar:1.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C15E268-8EB4-47A8-90DC-CD69CD50A841"
            },
            {
              "criteria": "cpe:2.3:a:webcalendar_project:webcalendar:1.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "91FEC4D3-4834-4280-8303-17DB2AFF5B02"
            },
            {
              "criteria": "cpe:2.3:a:webcalendar_project:webcalendar:1.0:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A495A3A9-D5D4-4520-BD08-E1ED14739011"
            },
            {
              "criteria": "cpe:2.3:a:webcalendar_project:webcalendar:1.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A080963-2939-4A64-AB20-88BCAE38493D"
            },
            {
              "criteria": "cpe:2.3:a:webcalendar_project:webcalendar:1.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4C91371D-782F-4F37-ACA2-DDCBCA07EADA"
            },
            {
              "criteria": "cpe:2.3:a:webcalendar_project:webcalendar:1.1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "05214A0F-8AF1-411D-A95D-C27E30DDDB90"
            },
            {
              "criteria": "cpe:2.3:a:webcalendar_project:webcalendar:1.1.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F0C4150C-F794-43E8-8830-306256B762A2"
            },
            {
              "criteria": "cpe:2.3:a:webcalendar_project:webcalendar:1.1.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7936AA3F-AF11-450E-B4C4-01435362A8BD"
            },
            {
              "criteria": "cpe:2.3:a:webcalendar_project:webcalendar:1.1.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE4761E3-3CC3-415C-B465-81D027A8873F"
            },
            {
              "criteria": "cpe:2.3:a:webcalendar_project:webcalendar:1.2:b1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "131F1948-C0F4-474B-B56B-B5F475B1E1A0"
            },
            {
              "criteria": "cpe:2.3:a:webcalendar_project:webcalendar:1.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1BE8D526-A7ED-4AAA-9B55-81AFA5761848"
            },
            {
              "criteria": "cpe:2.3:a:webcalendar_project:webcalendar:1.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5E2AE19F-7C9B-4AB3-8E7F-8FA7EDE0125F"
            },
            {
              "criteria": "cpe:2.3:a:webcalendar_project:webcalendar:1.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8810AF0D-2304-43B7-9507-DD429587E975"
            },
            {
              "criteria": "cpe:2.3:a:webcalendar_project:webcalendar:1.2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE45F7F3-C367-4E0C-973E-43907482B696"
            },
            {
              "criteria": "cpe:2.3:a:webcalendar_project:webcalendar:1.2.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AB7C9928-8A71-4C39-A690-9E19780E5A52"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}