CVE-2007-3182: Multiple cross-site scripting (XSS) vulnerabilities in Calendarix 0.7.20070307, when register_globals is enabl

This month

MEDIUM 4.3DOWNGRADE

CVE-2007-3182 is a medium-severity flaw (CVSS 4.3) affecting calendarix. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Multiple cross-site scripting (XSS) vulnerabilities in Calendarix 0.7.20070307, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) year and (2) month parameters to calendar.php, and the (3) leftfooter parameter to cal_footer.inc.php. NOTE: the ycyear parameter to yearcal.php is already covered by CVE-2006-1835.

Why this priority

EPSS top 9%: very likely to be exploited
Public exploit reference

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	4.3 (Medium)
EPSS exploit chance	4.3% (top 9%)
CISA exploited list	No
Published	2007-06-26
Last modified	2026-06-16

Publisher (CNA): MITRE · Vendor: vincent hor

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2007-06-26 17:30 UTCPublished CVE record published
2026-06-16 22:41 UTCUpdated Record last modified

vincent hor calendarix DOWNGRADE

Affected: 0.7.2007-03-07

Fixed in: no fixed release known

Safe to downgrade to: a release before 0.7.2007-03-07

1. Check installed version

apt-cache policy calendarix || rpm -q calendarix || calendarix --version

2. No fixed release: DOWNGRADE to a release before 0.7.2007-03-07 (Debian / Ubuntu)

apt-cache madison calendarix sudo apt install calendarix=<VERSION_BEFORE_0.7.2007-03-07> sudo apt-mark hold calendarix

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list calendarix sudo dnf downgrade calendarix-<VERSION_BEFORE_0.7.2007-03-07> sudo dnf versionlock add calendarix

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Exploit-DB: Calendarix 0.7.20070307 - Multiple Cross-Site Scripting Vulnerabilities

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2007-3182?

calendarix: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2007-3182 being exploited?

CVE-2007-3182 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2007-3182 affect?

CVE-2007-3182 affects calendarix. Severity is medium (CVSS 4.3). Multiple cross-site scripting (XSS) vulnerabilities in Calendarix 0.7.20070307, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) year and (2) month parameters to calendar.php, and t

How urgent is CVE-2007-3182?

Priority 43/100. EPSS top 9%: very likely to be exploited; Public exploit reference

Software pages

PHP vulnerabilities

Related CVEs

CVE-2007-3259 MEDIUM 5.0 DOWNGRADE Calendarix 0.7.20070307 allows remote attackers to obtain sensitive information via (1) an invalid month[] par
CVE-2007-3258 MEDIUM 5.0 DOWNGRADE calendar.php in Calendarix 0.7.20070307 allows remote attackers to obtain sensitive information via large valu
CVE-2007-3183 MEDIUM 6.8 DOWNGRADE Multiple SQL injection vulnerabilities in Calendarix 0.7.20070307, when magic_quotes_gpc is disabled, allow re
CVE-2006-4135 HIGH 7.5 UPGRADE PHP remote file inclusion vulnerability in cal_config.inc.php in Calendarix 0.7.20060401 and earlier allows re
CVE-2006-1835 LOW 2.6 DOWNGRADE DOWNGRADE Cross-site scripting (XSS) vulnerability in yearcal.php in Calendarix allows remote attackers to inject arbitr

References

← Back to latest CVEs