Vulnerability · Published Feb 25, 2021 · Assigned by mitre

CVE-2021-27330

Medium 6.1

In plain English

A medium-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.2% (higher than 94% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS NVD)6.1Medium

Exploit odds (30 days)6.2%top 6.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Nuclei

Official description

Triconsole Datepicker Calendar <3.77 is affected by cross-site scripting (XSS) in calendar_form.php. Attackers can read authentication cookies that are still active, which can be used to perform further attacks such as reading browser history, directory listings, and file contents.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.triconsole.com/ x_refsource_MISC
http://www.triconsole.com/php/calendar_datepicker.php x_refsource_MISC
https://www.exploit-db.com/exploits/49597 x_refsource_MISC
http://packetstormsecurity.com/files/161570/Triconsole-3.75-Cross-Site-Scripting.html x_refsource_MISC