CVE-2019-18345

CVE-2019-18345 describes a reflected Cross-Site Scripting (XSS) vulnerability in DAViCal versions up to 1.1.8, affecting various Debian-based distributions. This flaw allows an attacker to inject malicious scripts by manipulating the "action" parameter, which is echoed without proper encoding. With a CVSS score of 9.3 (CRITICAL), a successful exploit could lead to full compromise of the affected user's account, including data viewing and action execution, and potentially full application control if the victim is an administrator. While the vulnerability is critical and easily exploitable via a user interaction (e.g., clicking a malicious link), there is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.