CVE-2007-1111

This exploit demonstrates a cross-site scripting (XSS) vulnerability in Active Calendar 1.2.0 by injecting a script tag into the 'css' parameter of the 'y_3.php' file, which executes arbitrary JavaScript in the context of the affected site.

This exploit demonstrates a cross-site scripting (XSS) vulnerability in Active Calendar 1.2.0 by injecting a script tag into the 'css' parameter of the 'y_2.php' endpoint, which executes arbitrary JavaScript in the context of the affected site.

This exploit demonstrates a cross-site scripting (XSS) vulnerability in Active Calendar 1.2.0 by injecting a malicious script via the 'css' parameter in the URL. The script executes arbitrary JavaScript in the context of the affected site, potentially stealing cookie-based authentication credentials.

This exploit demonstrates a cross-site scripting (XSS) vulnerability in Active Calendar 1.2.0 by injecting a script tag into the 'css' parameter of the 'm_3.php' file, which executes arbitrary JavaScript in the context of the affected site.

This exploit demonstrates a cross-site scripting (XSS) vulnerability in Active Calendar 1.2.0 by injecting a malicious script via the 'css' parameter in the 'm_2.php' file. The script executes arbitrary JavaScript in the context of the affected site, potentially stealing cookie-based authentication credentials.

This exploit demonstrates a cross-site scripting (XSS) vulnerability in Active Calendar 1.2.0 by injecting a script tag into the 'css' parameter of the 'mysqlevents.php' file, which executes arbitrary JavaScript in the context of the affected site.

This exploit demonstrates a cross-site scripting (XSS) vulnerability in Active Calendar 1.2.0 by injecting a malicious script via the 'css' parameter in the 'js.php' file. The PoC uses a simple alert to display the user's cookies, proving the vulnerability.

This exploit demonstrates a cross-site scripting (XSS) vulnerability in Active Calendar 1.2.0 by injecting a script tag into the 'css' parameter of the 'flatevents.php' endpoint. The PoC triggers an alert with the user's cookies, proving arbitrary JavaScript execution.