VULNERABILITY INTELLIGENCE
CVE-2006-1292
CVSS score5 MEDIUM
EPSS probability2.85%
CISA KEVNot currently listed
Published2006-03-19
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:N/I:P/A:N
Description
Directory traversal vulnerability in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in the phpicalendar[cookie_language] and phpicalendar[cookie_style] cookies, as demonstrated by injecting PHP sequences into an Apache access_log file, which is then included by day.php.