CVE-2007-6696

This exploit demonstrates an XSS vulnerability in WebCalendar 1.1.6 by injecting malicious script code via the 'adv' parameter in search.php. The payload uses HTML-encoded JavaScript to trigger an alert, proving arbitrary script execution in the context of the affected site.

This exploit demonstrates an XSS vulnerability in WebCalendar 1.1.6 by injecting a script tag into the URL, which executes arbitrary JavaScript in the context of the affected site. The PoC leverages improper input sanitization in the `pref.php` endpoint.