Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2005-3571: PHP file inclusion vulnerability in protection.php in CodeGrrl (a) PHPCalendar 1.0, (b) PHPClique 1.0, (c) PHP

45
This month
MEDIUM 5.0UPGRADEUPGRADEUPGRADE

CVE-2005-3571 is a medium-severity flaw (CVSS 5.0) affecting phpcalendar, phpclique, phpcurrently. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

PHP file inclusion vulnerability in protection.php in CodeGrrl (a) PHPCalendar 1.0, (b) PHPClique 1.0, (c) PHPCurrently 2.0, (d) PHPFanBase 2.1, and (e) PHPQuotes 1.0 allows remote attackers to include arbitrary local files via the siteurl parameter when register_globals is enabled. NOTE: It was later reported that PHPFanBase 2.2 is also affected.

Why this priority

  • Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score5.0 (Medium)
EPSS exploit chance3.5% (top 11%)
CISA exploited listNo
WeaknessCWE-94
Published2005-11-16
Last modified2026-06-16
Publisher (CNA): MITRE · Vendor: codegrrl

Share: LinkedIn · X · Reddit

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

codegrrl phpcalendar UPGRADE
Affected: <= 1.0
Fixed in: newer than 1.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy phpcalendar || rpm -q phpcalendar || phpcalendar --version
2. UPGRADE to newer than 1.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade phpcalendar
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade phpcalendar
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
codegrrl phpclique UPGRADE
Affected: <= 1.0
Fixed in: newer than 1.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy phpclique || rpm -q phpclique || phpclique --version
2. UPGRADE to newer than 1.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade phpclique
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade phpclique
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
codegrrl phpcurrently UPGRADE
Affected: <= 2.0
Fixed in: newer than 2.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy phpcurrently || rpm -q phpcurrently || phpcurrently --version
2. UPGRADE to newer than 2.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade phpcurrently
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade phpcurrently
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
codegrrl phpfanbase UPGRADE
Affected: <= 2.2
Fixed in: newer than 2.2
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy phpfanbase || rpm -q phpfanbase || phpfanbase --version
2. UPGRADE to newer than 2.2 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade phpfanbase
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade phpfanbase
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
codegrrl phpquotes UPGRADE
Affected: <= 1.0
Fixed in: newer than 1.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy phpquotes || rpm -q phpquotes || phpquotes --version
2. UPGRADE to newer than 1.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade phpquotes
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade phpquotes
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2005-3571?

phpcalendar: upgrade to newer than 1.0; phpclique: upgrade to newer than 1.0; phpcurrently: upgrade to newer than 2.0. Exact commands for each OS are on this page.

Is CVE-2005-3571 being exploited?

CVE-2005-3571 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2005-3571 affect?

CVE-2005-3571 affects phpcalendar, phpclique, phpcurrently. Severity is medium (CVSS 5.0). PHP file inclusion vulnerability in protection.php in CodeGrrl (a) PHPCalendar 1.0, (b) PHPClique 1.0, (c) PHPCurrently 2.0, (d) PHPFanBase 2.1, and (e) PHPQuotes 1.0 allows remote attackers to include arbitrary local files via the siteurl

How urgent is CVE-2005-3571?

Priority 45/100. Public exploit reference

Software pages

PHP vulnerabilities

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.