https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2006-6229.htmlhttps://patchthecve.com/cve/CVE-2006-6229.htmlTue, 16 Jun 2026 22:32:43 +0000MEDIUM 5.0: Codewalkers ltwCalendar (aka PHP Event Calendar) before 4.2.1 logs failed passwords, which might allow attackers to infer correct passwords from the log file.https://patchthecve.com/cve/CVE-2006-6228.htmlhttps://patchthecve.com/cve/CVE-2006-6228.htmlTue, 16 Jun 2026 22:32:43 +0000MEDIUM 6.8: Cross-site scripting (XSS) vulnerability in Codewalkers ltwCalendar (aka PHP Event Calendar) before 4.2.1 allows remote attackers to inject arbitrary HTML or web script via unknown vectors.https://patchthecve.com/cve/CVE-2006-3041.htmlhttps://patchthecve.com/cve/CVE-2006-3041.htmlTue, 16 Jun 2026 22:26:16 +0000HIGH 7.5: PHP remote file inclusion vulnerability in Ltwcalendar/calendar.php in Codewalkers Ltwcalendar 4.1.3 allows remote attackers to execute arbitrary PHP code via a URL in the ltw_config[include_dir] parameter. NOTE: CVE disputes this claim, since the $ltw_config[include_dir] variable is defined as a sthttps://patchthecve.com/cve/CVE-2005-4011.htmlhttps://patchthecve.com/cve/CVE-2005-4011.htmlTue, 16 Jun 2026 22:18:03 +0000HIGH 7.5: SQL injection vulnerability in calendar.php in Codewalkers ltwCalendar (aka PHP Event Calendar) 4.2, 4.1.3, and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.