What’s Vulnerable › Vulnerabilities

CVE-2022-4455: sproctor php-calendar index.php cross site scripting

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-12-13 · updated 2026-06-17
• Weakness: CWE-79

Description

A vulnerability was identified in sproctor php-calendar up to 2.0.13. This impacts an unknown function of the file index.php. Such manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be launched remotely. The name of the patch is a2941109b42201c19733127ced763e270a357809. It is advisable to implement a patch to correct this issue.

Affected products

• sproctor php-calendar: before 2022-04-28 — fixed in 2022-04-28

How to fix

Upgrade to a fixed version: sproctor php-calendar 2022-04-28. Check the vendor advisory for mitigations.

References

• https://github.com/sproctor/php-calendar/commit/a2941109b42201c19733127ced763e270a357809
• https://vuldb.com/?ctiid.215445
• https://vuldb.com/?id.215445
• https://github.com/sproctor/php-calendar/commit/a2941109b42201c19733127ced763e270a357809
• https://vuldb.com/?id.215445

Get alerted when CVE-2022-4455 or the next vulnerability affects your stack