CVE-2008-2836: k5n Webcalendar

High severity, CVSS 7.5. EPSS: 3.1% chance of exploitation in the next 30 days.

PHP remote file inclusion vulnerability in send_reminders.php in WebCalendar 1.0.4 allows remote attackers to execute arbitrary PHP code via a URL in the includedir parameter and a 0 value for the noSet parameter, a different vector than CVE-2007-1483.

Affected products

• k5n Webcalendar: version 1.0.4 only

Published 2008-06-24. Last modified 2026-06-16.