CVE-2022-4455: PHP-Calendar

Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days.

A vulnerability was identified in sproctor php-calendar up to 2.0.13. This impacts an unknown function of the file index.php. Such manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be launched remotely. The name of the patch is a2941109b42201c19733127ced763e270a357809. It is advisable to implement a patch to correct this issue.

Affected products

• PHP-Calendar PHP-Calendar: before 2022-04-28 (fixed in 2022-04-28)

Published 2022-12-13. Last modified 2026-06-17.