CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Room 34 Creative Services, LLC ICS Calendar ics-calendar allows Reflected XSS.This issue affects ICS Calendar: from n/a through <= 12.1.1.
Explanation of Vulnerability in Simple Terms
ICS Calendar versions 12.1.1 and earlier contain a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the application. When a victim visits a crafted page or link, the injected code executes in their browser with access to their session. The vulnerability affects multiple users and can compromise site integrity or steal sensitive data.
What an attacker can do
Inject malicious JavaScript that runs in visitors' browsers and steals session data or modifies page content.
Potential impact on your site
Visitors' sessions and data can be compromised; site reputation and user trust may be damaged.
Conditions required to exploit
Attacker must craft a malicious link or page; victim must visit it while logged in or using the site.
Key dates
External resources
Related vulnerabilities
