source: https://www.securityfocus.com/bid/26312/info Helios Calendar is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue allows attackers to execute arbitrary HTML or script code in a user's browser session in the context of an affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue affects Helios Calendar 1.2.1 Beta; other versions may also be affected. http://www.example.com/calendar/admin/index.php?msg=1&username=[XSS]