CVE-2019-18347

A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.

• CWE-79

• http://packetstormsecurity.com/files/155628/DAViCal-CalDAV-Server-1.1.8-Persistent-Cross-Site-Scripting.htmlThird Party Advisory
• http://seclists.org/fulldisclosure/2019/Dec/17Third Party Advisory
• http://seclists.org/fulldisclosure/2019/Dec/18Third Party Advisory
• http://seclists.org/fulldisclosure/2019/Dec/19Third Party Advisory
• https://gitlab.com/davical-project/davical/blob/master/ChangeLogRelease Notes, Third Party Advisory
• https://hackdefense.com/publications/cve-2019-18347-davical-caldav-server-vulnerability/Exploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/12/msg00016.html
• https://seclists.org/bugtraq/2019/Dec/30
• https://www.davical.org/Product
• https://www.debian.org/security/2019/dsa-4582
• http://packetstormsecurity.com/files/155628/DAViCal-CalDAV-Server-1.1.8-Persistent-Cross-Site-Scripting.htmlThird Party Advisory
• http://seclists.org/fulldisclosure/2019/Dec/17Third Party Advisory
• http://seclists.org/fulldisclosure/2019/Dec/18Third Party Advisory
• http://seclists.org/fulldisclosure/2019/Dec/19Third Party Advisory
• https://gitlab.com/davical-project/davical/blob/master/ChangeLogRelease Notes, Third Party Advisory
• https://hackdefense.com/publications/cve-2019-18347-davical-caldav-server-vulnerability/Exploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/12/msg00016.html
• https://seclists.org/bugtraq/2019/Dec/30
• https://www.davical.org/Product
• https://www.debian.org/security/2019/dsa-4582

Published

Dec 4, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-18340A vulnerability has been identified in Control Center Server…5.5
• CVE-2019-18341A vulnerability has been identified in Control Center Server…5.3
• CVE-2019-18342A vulnerability has been identified in Control Center Server…9.9
• CVE-2019-18344Sourcecodester Online Grading System 1.0 is vulnerable to un…9.8
• CVE-2019-18345A reflected XSS issue was discovered in DAViCal through 1.1.…9.3
• CVE-2019-18346A CSRF issue was discovered in DAViCal through 1.1.8. If an …8.8
• CVE-2019-18348An issue was discovered in urllib2 in Python 2.x through 2.7…6.1
• CVE-2019-18349HotkeyP through 4.9 r96 allows privilege escalation in the p…9.8
• CVE-2019-1835A vulnerability in the CLI of Cisco Aironet Access Points (A…4.4
• CVE-2019-18350In Ant Design Pro 4.0.0, reflected XSS in the user/login red…6.1
• CVE-2019-18351Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-18352Improper access control exists on PHOENIX CONTACT FL NAT 220…8.2