CVE-2006-3684: Softcomplex PHP Event Calendar

High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days.

PHP remote file inclusion vulnerability in calendar.php in SoftComplex PHP Event Calendar 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_calendar parameter, which overwrites the $path_to_calendar variable from an extract function call.

Affected products

• Softcomplex PHP Event Calendar: version 1.4 only

Published 2006-07-21. Last modified 2026-06-16.