CVE-2019-18345

A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes
the action parameter without encoding. If a user visits an
attacker-supplied link, the attacker can view all data the attacked user
can view, as well as perform all actions in the name of the user. If the
user is an administrator, the attacker can for example add a new admin user
to gain full access to the application.