https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2006-2261.htmlhttps://patchthecve.com/cve/CVE-2006-2261.htmlTue, 16 Jun 2026 22:24:39 +0000HIGH 7.5: PHP remote file inclusion vulnerability in day.php in ACal 2.2.6 allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.https://patchthecve.com/cve/CVE-2006-0183.htmlhttps://patchthecve.com/cve/CVE-2006-0183.htmlTue, 16 Jun 2026 22:20:03 +0000MEDIUM 6.5: Direct static code injection vulnerability in edit.php in ACal Calendar Project 2.2.5 allows authenticated users to execute arbitrary PHP code via (1) the edit=header value, which modifies header.php, or (2) the edit=footer value, which modifies footer.php. NOTE: this issue might be resultant from https://patchthecve.com/cve/CVE-2006-0182.htmlhttps://patchthecve.com/cve/CVE-2006-0182.htmlTue, 16 Jun 2026 22:20:03 +0000HIGH 7.5: login.php in ACal Calendar Project 2.2.5 allows remote attackers to bypass authentication by setting the ACalAuthenticate cookie variable to "inside".