CVE-2004-1423: PHP-Calendar

High severity, CVSS 7.5. EPSS: 15.5% chance of exploitation in the next 30 days.

Multiple PHP remote file inclusion vulnerabilities in Sean Proctor PHP-Calendar before 0.10.1, as used in Commonwealth of Massachusetts Virtual Law Office (VLO) and other products, allow remote attackers to execute arbitrary PHP code via a URL in the phpc_root_path parameter to (1) includes/calendar.php or (2) includes/setup.php.

Affected products

• PHP-Calendar PHP-Calendar: up to and including 0.10; version 0.1 only; version 0.2 only; version 0.3 only; version 0.4 only; version 0.5 only; …

Published 2004-12-31. Last modified 2026-06-16.