CVE-2004-1506: Webcalendar

Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar allow remote attackers to inject arbitrary web script via (1) view_entry.php, (2) view_d.php, (3) usersel.php, (4) datesel.php, (5) trailer.php, or (6) styles.php, as demonstrated using img srg tags.

Affected products

• Webcalendar Webcalendar: version 0.9.8 only; version 0.9.11 only; version 0.9.15 only; version 0.9.16 only; version 0.9.19 only; version 0.9.20 only; …

Published 2004-12-31. Last modified 2026-06-16.