CVE-2006-1336

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-03-21 · updated 2026-06-16

Description

Cross-site scripting vulnerability in calendar.php in ExtCalendar 1.0 and possibly other versions before 2.0 allows remote attackers to inject arbitrary web script or HTML via the (1) year, (2) month, (3) next, and (4) prev parameters.

Affected products

Extcalendar: 1.0

References

http://secunia.com/advisories/19321
http://securityreason.com/securityalert/601
http://www.osvdb.org/23969
http://www.securityfocus.com/archive/1/428131/100/0/threaded
http://www.securityfocus.com/bid/17146
http://www.vupen.com/english/advisories/2006/1012
https://exchange.xforce.ibmcloud.com/vulnerabilities/25350
http://secunia.com/advisories/19321
http://securityreason.com/securityalert/601
http://www.osvdb.org/23969
http://www.securityfocus.com/archive/1/428131/100/0/threaded
http://www.securityfocus.com/bid/17146

Get alerted when CVE-2006-1336 or the next vulnerability affects your stack