Vulnerability Description
Triconsole Datepicker Calendar <3.77 is affected by cross-site scripting (XSS) in calendar_form.php. Attackers can read authentication cookies that are still active, which can be used to perform further attacks such as reading browser history, directory listings, and file contents.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Triconsole | Datepicker Calendar | < 3.77 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/161570/Triconsole-3.75-Cross-Site-ScriptingExploitThird Party Advisory
- http://www.triconsole.com/Product
- http://www.triconsole.com/php/calendar_datepicker.phpProduct
- https://www.exploit-db.com/exploits/49597ExploitThird Party Advisory
- http://packetstormsecurity.com/files/161570/Triconsole-3.75-Cross-Site-ScriptingExploitThird Party Advisory
- http://www.triconsole.com/Product
- http://www.triconsole.com/php/calendar_datepicker.phpProduct
- https://www.exploit-db.com/exploits/49597ExploitThird Party Advisory
FAQ
What is CVE-2021-27330?
CVE-2021-27330 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Triconsole Datepicker Calendar <3.77 is affected by cross-site scripting (XSS) in calendar_form.php. Attackers can read authentication cookies that are still active, which can be used to perform furth...
How severe is CVE-2021-27330?
CVE-2021-27330 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-27330?
Check the references section above for vendor advisories and patch information. Affected products include: Triconsole Datepicker Calendar.