CVE-2005-3366

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-10-30 · updated 2026-06-16

Description

PHP file inclusion vulnerability in index.php in PHP iCalendar 2.0a2 through 2.0.1 allows remote attackers to execute arbitrary PHP code and include arbitrary local files via the phpicalendar cookie. NOTE: this is not a cross-site scripting (XSS) issue as claimed by the original researcher.

Affected products

Php Icalendar: 2.0.1, 2.0a2, 2.0b, 2.0c

References

http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0512.html
http://marc.info/?l=bugtraq&m=113025930517426&w=2
http://secunia.com/advisories/17328/
http://securityreason.com/securityalert/113
http://securitytracker.com/id?1015102
http://www.securityfocus.com/bid/15193
http://www.ush.it/2005/10/25/php-icalendar-css/
http://www.vupen.com/english/advisories/2005/2204
https://exchange.xforce.ibmcloud.com/vulnerabilities/22864
http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0512.html
http://marc.info/?l=bugtraq&m=113025930517426&w=2
http://secunia.com/advisories/17328/

Get alerted when CVE-2005-3366 or the next vulnerability affects your stack