CVE-2006-1336
ExtCalendar 1.0 - Cross-Site Scripting via Year Month Next or Prev Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-1336. PoCs published by Soothackers.
AI-analyzed exploit summary This exploit demonstrates four XSS vulnerabilities in ExtCalendar due to improper input sanitization. The PoC provides URLs with injected script tags that trigger arbitrary JavaScript execution in the context of the affected site.
Description
Cross-site scripting vulnerability in calendar.php in ExtCalendar 1.0 and possibly other versions before 2.0 allows remote attackers to inject arbitrary web script or HTML via the (1) year, (2) month, (3) next, and (4) prev parameters.
Exploits (1)
This exploit demonstrates four XSS vulnerabilities in ExtCalendar due to improper input sanitization. The PoC provides URLs with injected script tags that trigger arbitrary JavaScript execution in the context of the affected site.