PatchTheCVECVE-2006-6824: Multiple cross-site scripting (XSS) vulnerabilities in Jim Hu and Chad Little PHP iCalendar 2.23 rc1 and earli
CVE-2006-6824 is a medium-severity flaw (CVSS 4.3) affecting php icalendar. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Multiple cross-site scripting (XSS) vulnerabilities in Jim Hu and Chad Little PHP iCalendar 2.23 rc1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) getdate parameter in (a) day.php, (b) month.php, (c) year.php, (d) week.php, (e) search.php, (f) rss/index.php, (g) print.php, and (h) preferences.php; the (2) cpath parameter in (i) day.php, (j) month.php, (k) year.php, (l) week.php, and (m) search.php; the (3)
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.3 (Medium) |
| EPSS exploit chance | 2.6% (top 15%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2006-12-29 |
| Last modified | 2026-06-16 |
Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Exploit-DB: PHP iCalendar 1.1/2.x - 'day.php' Cross-Site Scripting
- Exploit-DB: PHP iCalendar 1.1/2.x - 'getdate' Cross-Site Scripting
- Exploit-DB: PHP iCalendar 1.1/2.x - 'month.php' Cross-Site Scripting
- Exploit-DB: PHP iCalendar 1.1/2.x - 'preferences.php' Cross-Site Scripting
- Exploit-DB: PHP iCalendar 1.1/2.x - 'print.php' Cross-Site Scripting
- Exploit-DB: PHP iCalendar 1.1/2.x - 'search.php' Cross-Site Scripting
- Exploit-DB: PHP iCalendar 1.1/2.x - 'week.php' Cross-Site Scripting
- Exploit-DB: PHP iCalendar 1.1/2.x - 'year.php' Cross-Site Scripting
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2006-6824?
php icalendar: upgrade to newer than 2.23_rc1. Exact commands for each OS are on this page.
Is CVE-2006-6824 being exploited?
CVE-2006-6824 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2006-6824 affect?
CVE-2006-6824 affects php icalendar. Severity is medium (CVSS 4.3). Multiple cross-site scripting (XSS) vulnerabilities in Jim Hu and Chad Little PHP iCalendar 2.23 rc1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) getdate parameter in (a) day.php, (b) month.php, (c)
How urgent is CVE-2006-6824?
Priority 41/100. Public exploit reference
Software pages
Related CVEs
- CVE-2011-3780 MEDIUM 5.0 DOWNGRADE PHP iCalendar 2.4 allows remote attackers to obtain sensitive information via a direct request to a .php file,
- CVE-2006-3319 MEDIUM 4.3 UPGRADE Cross-site scripting (XSS) vulnerability in rss/index.php in PHP iCalendar 2.22 and earlier allows remote atta
- CVE-2006-1292 MEDIUM 5.0 UPGRADE Directory traversal vulnerability in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier allows remote attac
- CVE-2006-1291 HIGH 7.5 UPGRADE publish.ical.php in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier does not require authentication for
- CVE-2006-0648 MEDIUM 5.0 DOWNGRADE Multiple directory traversal vulnerabilities in PHP iCalendar 2.0.1, 2.1, and 2.2 allow remote attackers to in