CVE-2019-18345

A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an administrator, the attacker can for example add a new admin user to gain full access to the application.

• CWE-79

• http://packetstormsecurity.com/files/155630/DAViCal-CalDAV-Server-1.1.8-Reflective-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://gitlab.com/davical-project/davical/blob/master/ChangeLogRelease Notes, Third Party Advisory
• https://hackdefense.com/publications/cve-2019-18345-davical-caldav-server-vulnerability/Exploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/12/msg00016.htmlMailing List, Third Party Advisory
• https://seclists.org/bugtraq/2019/Dec/30Mailing List, Third Party Advisory
• https://wiki.davical.org/index.php/Main_PageProduct, Vendor Advisory
• https://www.davical.org/Product, Vendor Advisory
• https://www.debian.org/security/2019/dsa-4582Third Party Advisory
• http://packetstormsecurity.com/files/155630/DAViCal-CalDAV-Server-1.1.8-Reflective-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://gitlab.com/davical-project/davical/blob/master/ChangeLogRelease Notes, Third Party Advisory
• https://hackdefense.com/publications/cve-2019-18345-davical-caldav-server-vulnerability/Exploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/12/msg00016.htmlMailing List, Third Party Advisory
• https://seclists.org/bugtraq/2019/Dec/30Mailing List, Third Party Advisory
• https://wiki.davical.org/index.php/Main_PageProduct, Vendor Advisory
• https://www.davical.org/Product, Vendor Advisory
• https://www.debian.org/security/2019/dsa-4582Third Party Advisory

Published

Dec 12, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-18339A vulnerability has been identified in SiNVR/SiVMS Video Ser…9.8
• CVE-2019-1834A vulnerability in the internal packet processing of Cisco A…7.4
• CVE-2019-18340A vulnerability has been identified in Control Center Server…5.5
• CVE-2019-18341A vulnerability has been identified in Control Center Server…5.3
• CVE-2019-18342A vulnerability has been identified in Control Center Server…9.9
• CVE-2019-18344Sourcecodester Online Grading System 1.0 is vulnerable to un…9.8
• CVE-2019-18346A CSRF issue was discovered in DAViCal through 1.1.8. If an …8.8
• CVE-2019-18347A stored XSS issue was discovered in DAViCal through 1.1.8. …5.4
• CVE-2019-18348An issue was discovered in urllib2 in Python 2.x through 2.7…6.1
• CVE-2019-18349HotkeyP through 4.9 r96 allows privilege escalation in the p…9.8
• CVE-2019-1835A vulnerability in the CLI of Cisco Aironet Access Points (A…4.4
• CVE-2019-18350In Ant Design Pro 4.0.0, reflected XSS in the user/login red…6.1