{"api_version":"1","generated_at":"2026-07-23T09:37:25+00:00","cve":"CVE-2006-0206","urls":{"html":"https://cve.report/CVE-2006-0206","api":"https://cve.report/api/cve/CVE-2006-0206.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-0206","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-0206"},"summary":{"title":"CVE-2006-0206","description":"Eval injection vulnerability in Light Weight Calendar (LWC) 1.0 (20040909) and earlier allows remote attackers to execute arbitrary PHP code via the date parameter in cal.php, which is included by index.php.","state":"PUBLISHED","assigner":"mitre","published_at":"2006-01-13 23:03:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://evuln.com/vulns/29/exploit.html","name":"http://evuln.com/vulns/29/exploit.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"eVuln.com - Light Weight Calendar PHP Code Execution","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/18450","name":"http://secunia.com/advisories/18450","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Vendor Advisory"],"title":"Light Weight Calendar \"date\" PHP Code Execution Vulnerability - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/24110","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/24110","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/421920","name":"http://www.securityfocus.com/archive/1/421920","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/16229","name":"http://www.securityfocus.com/bid/16229","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Light Weight Calendar Index.PHP Remote Command Execution Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://evuln.com/vulns/29/summary.html","name":"http://evuln.com/vulns/29/summary.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Vendor Advisory"],"title":"eVuln.com - Light Weight Calendar PHP Code Execution","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://attrition.org/pipermail/vim/2006-March/000612.html","name":"http://attrition.org/pipermail/vim/2006-March/000612.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[VIM] Source VERIFY - Light Weight Calendar issue is eval injection","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2006/0171","name":"http://www.vupen.com/english/advisories/2006/0171","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/22376","name":"http://www.osvdb.org/22376","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-0206","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-0206","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"206","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"light_weight_calendar","cpe5":"light_weight_calendar","cpe6":"1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T16:25:33.979Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"http://evuln.com/vulns/29/exploit.html"},{"name":"18450","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/18450"},{"name":"16229","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/16229"},{"name":"20060318 Source VERIFY - Light Weight Calendar issue is eval injection","tags":["mailing-list","x_refsource_VIM","x_transferred"],"url":"http://attrition.org/pipermail/vim/2006-March/000612.html"},{"name":"lwc-cal-execute-code(24110)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/24110"},{"name":"22376","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/22376"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://evuln.com/vulns/29/summary.html"},{"name":"ADV-2006-0171","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2006/0171"},{"name":"20060113 [eVuln] Light Weight Calendar PHP Code Execution","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/421920"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2006-01-12T00:00:00.000Z","descriptions":[{"lang":"en","value":"Eval injection vulnerability in Light Weight Calendar (LWC) 1.0 (20040909) and earlier allows remote attackers to execute arbitrary PHP code via the date parameter in cal.php, which is included by index.php."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-07-19T15:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"http://evuln.com/vulns/29/exploit.html"},{"name":"18450","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/18450"},{"name":"16229","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/16229"},{"name":"20060318 Source VERIFY - Light Weight Calendar issue is eval injection","tags":["mailing-list","x_refsource_VIM"],"url":"http://attrition.org/pipermail/vim/2006-March/000612.html"},{"name":"lwc-cal-execute-code(24110)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/24110"},{"name":"22376","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/22376"},{"tags":["x_refsource_MISC"],"url":"http://evuln.com/vulns/29/summary.html"},{"name":"ADV-2006-0171","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2006/0171"},{"name":"20060113 [eVuln] Light Weight Calendar PHP Code Execution","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/421920"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-0206","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Eval injection vulnerability in Light Weight Calendar (LWC) 1.0 (20040909) and earlier allows remote attackers to execute arbitrary PHP code via the date parameter in cal.php, which is included by index.php."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://evuln.com/vulns/29/exploit.html","refsource":"MISC","url":"http://evuln.com/vulns/29/exploit.html"},{"name":"18450","refsource":"SECUNIA","url":"http://secunia.com/advisories/18450"},{"name":"16229","refsource":"BID","url":"http://www.securityfocus.com/bid/16229"},{"name":"20060318 Source VERIFY - Light Weight Calendar issue is eval injection","refsource":"VIM","url":"http://attrition.org/pipermail/vim/2006-March/000612.html"},{"name":"lwc-cal-execute-code(24110)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/24110"},{"name":"22376","refsource":"OSVDB","url":"http://www.osvdb.org/22376"},{"name":"http://evuln.com/vulns/29/summary.html","refsource":"MISC","url":"http://evuln.com/vulns/29/summary.html"},{"name":"ADV-2006-0171","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2006/0171"},{"name":"20060113 [eVuln] Light Weight Calendar PHP Code Execution","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/421920"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2006-0206","datePublished":"2006-01-13T23:00:00.000Z","dateReserved":"2006-01-13T00:00:00.000Z","dateUpdated":"2024-08-07T16:25:33.979Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2006-01-13 23:03:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:light_weight_calendar:light_weight_calendar:1.0:*:*:*:*:*:*:*","matchCriteriaId":"FA2D9CE2-E12E-4325-8B39-22E6D2295ADF"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"206","Ordinal":"1","Title":"CVE-2006-0206","CVE":"CVE-2006-0206","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"206","Ordinal":"1","NoteData":"Eval injection vulnerability in Light Weight Calendar (LWC) 1.0 (20040909) and earlier allows remote attackers to execute arbitrary PHP code via the date parameter in cal.php, which is included by index.php.","Type":"Description","Title":"CVE-2006-0206"},{"CveYear":"2006","CveId":"206","Ordinal":"2","NoteData":"2006-01-13","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"206","Ordinal":"3","NoteData":"2017-07-19","Type":"Other","Title":"Modified"}]}}}