CVE-2021-27330

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Triconsole Datepicker Calendar <3.77 is affected by cross-site scripting (XSS) in calendar_form.php. Attackers can read authentication cookies that are still active, which can be used to perform further attacks such as reading browser history, directory listings, and file contents.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/161570/Triconsole-3.75-Cross-Site-Scripting.htmlExploit, Third Party Advisory
http://www.triconsole.com/Product
http://www.triconsole.com/php/calendar_datepicker.phpProduct
https://www.exploit-db.com/exploits/49597Exploit, Third Party Advisory
http://packetstormsecurity.com/files/161570/Triconsole-3.75-Cross-Site-Scripting.htmlExploit, Third Party Advisory
http://www.triconsole.com/Product
http://www.triconsole.com/php/calendar_datepicker.phpProduct
https://www.exploit-db.com/exploits/49597Exploit, Third Party Advisory

Timeline

Published: Feb 25, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-273326.1Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitra CVE-2021-273359.8KollectApps before 4.8.16c is affected by insecure Java deserialization, leading to Remote Code Execution via a ysoserial.payloads.CommonsCo CVE-2021-273385.4Faraday Edge before 3.7 allows XSS via the network/create/ page and its network name parameter.CVE-2021-273406.1OpenSIS Community Edition version <= 7.6 is affected by a reflected XSS vulnerability in EmailCheck.php via the "opt" parameter.CVE-2021-273419.8OpenSIS Community Edition version <= 7.6 is affected by a local file inclusion vulnerability in DownloadWindow.php via the "filename" parame CVE-2021-273425.9An authentication brute-force protection mechanism bypass in telnetd in D-Link Router model DIR-842 firmware version 3.0.2 allows a remote a CVE-2021-273437.5SerenityOS Unspecified is affected by: Buffer Overflow. The impact is: obtain sensitive information (context-dependent). The component is: /CVE-2021-273455.5A null pointer dereference was discovered in ucompthread in stream.c in Irzip 0.631 which allows attackers to cause a denial of service (DOS CVE-2021-273475.5Use after free in lzma_decompress_buf function in stream.c in Irzip 0.631 allows attackers to cause Denial of Service (DoS) via a crafted co CVE-2021-273496.1Advanced Order Export before 3.1.8 for WooCommerce allows XSS, a different vulnerability than CVE-2020-11727.CVE-2021-273515.3The Terminate Session feature in the Telegram application through 7.2.1 for Android, and through 2.4.7 for Windows and UNIX, fails to invali CVE-2021-273525.4An open redirect vulnerability in Ilch CMS version 2.1.42 allows attackers to redirect users to an attacker's site after a successful login.