CVE-2022-4455
LOWphp-calendar < 2022-04-28 - Cross-Site Scripting via $_SERVER['PHP_SELF']
Title source: llmDescription
A vulnerability was identified in sproctor php-calendar up to 2.0.13. This impacts an unknown function of the file index.php. Such manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be launched remotely. The name of the patch is a2941109b42201c19733127ced763e270a357809. It is advisable to implement a patch to correct this issue.
References (3)
Core 3
Core References
Third Party Advisory vdb-entry
technical-description
https://vuldb.com/?id.215445
Permissions Required, VDB Entry signature
permissions-required
https://vuldb.com/?ctiid.215445
Patch, Third Party Advisory patch
https://github.com/sproctor/php-calendar/commit/a2941109b42201c19733127ced763e270a357809
Scores
CVSS v3
3.5
EPSS
0.0057
EPSS Percentile
43.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-79
CWE-94
Status
published
Products (1)
php-calendar/php-calendar
< 2022-04-28
Published
Dec 13, 2022
Tracked Since
Feb 18, 2026