What’s Vulnerable › Vulnerabilities

CVE-2017-9072

• Severity: medium (CVSS 6.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-05-18 · updated 2026-06-17
• Weakness: CWE-79

Description

Two CalendarXP products have XSS in common parts of HTML files. CalendarXP FlatCalendarXP through 9.9.290 has XSS in iflateng.htm and nflateng.htm. CalendarXP PopCalendarXP through 9.8.308 has XSS in ipopeng.htm and npopeng.htm.

Affected products

• Calendarxp Flatcalendarxp: through 9.9.290
• Calendarxp Popcalendarxp: through 9.8.308

References

• http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
• http://www.securityfocus.com/bid/102632
• https://github.com/victorwon/calendarxp/issues/2
• http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
• http://www.securityfocus.com/bid/102632
• https://github.com/victorwon/calendarxp/issues/2

Get alerted when CVE-2017-9072 or the next vulnerability affects your stack