{"api_version":"1","generated_at":"2026-07-23T10:22:38+00:00","cve":"CVE-2006-6824","urls":{"html":"https://cve.report/CVE-2006-6824","api":"https://cve.report/api/cve/CVE-2006-6824.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-6824","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-6824"},"summary":{"title":"CVE-2006-6824","description":"Multiple cross-site scripting (XSS) vulnerabilities in Jim Hu and Chad Little PHP iCalendar 2.23 rc1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) getdate parameter in (a) day.php, (b) month.php, (c) year.php, (d) week.php, (e) search.php, (f) rss/index.php, (g) print.php, and (h) preferences.php; the (2) cpath parameter in (i) day.php, (j) month.php, (k) year.php, (l) week.php, and (m) search.php; the (3) query parameter in search.php; and possibly the cpath, (4) unset, and (5) set parameters in a setcookie action in preferences.php; different vectors than CVE-2006-3319.  NOTE: it was later reported that vectors b, c, and d also affect 2.24.","state":"PUBLISHED","assigner":"mitre","published_at":"2006-12-29 11:28:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.osvdb.org/32495","name":"http://www.osvdb.org/32495","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.securityfocus.com/bid/21792","name":"http://www.securityfocus.com/bid/21792","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"PHP ICalendar Multiple Cross-Site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/31146","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/31146","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securitytracker.com/id?1017449","name":"http://securitytracker.com/id?1017449","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"PHP iCalendar Input Validation Holes in 'cpath' and 'getdate' Parameters Permit Cross-Site Scripting Attacks - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/32497","name":"http://www.osvdb.org/32497","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/32498","name":"http://www.osvdb.org/32498","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/32493","name":"http://www.osvdb.org/32493","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.securityfocus.com/archive/1/485397/100/200/threaded","name":"http://www.securityfocus.com/archive/1/485397/100/200/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/32500","name":"http://www.osvdb.org/32500","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://secunia.com/advisories/23499","name":"http://secunia.com/advisories/23499","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"PHP iCalendar Multiple Cross-Site Scripting Vulnerabilities - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/32499","name":"http://www.osvdb.org/32499","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/32496","name":"http://www.osvdb.org/32496","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://lostmon.blogspot.com/2006/12/php-icalendar-multiple-variable-cross.html","name":"http://lostmon.blogspot.com/2006/12/php-icalendar-multiple-variable-cross.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Lostmon Blogger: PHP icalendar multiple variable cross site scripting","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/32494","name":"http://www.osvdb.org/32494","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-6824","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-6824","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"6824","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"php_icalendar","cpe5":"php_icalendar","cpe6":"1.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"6824","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"php_icalendar","cpe5":"php_icalendar","cpe6":"2.22","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"6824","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"php_icalendar","cpe5":"php_icalendar","cpe6":"2.24","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"6824","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"php_icalendar","cpe5":"php_icalendar","cpe6":"2.2_beta","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"6824","vulnerable":"1","versionEndIncluding":"2.23_rc1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"php_icalendar","cpe5":"php_icalendar","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T20:42:07.358Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"32498","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/32498"},{"name":"32493","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/32493"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://lostmon.blogspot.com/2006/12/php-icalendar-multiple-variable-cross.html"},{"name":"32496","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/32496"},{"name":"20071220 PHP iCalendar <= 2.24 - Cross-Site Scripting Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/485397/100/200/threaded"},{"name":"32500","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/32500"},{"name":"1017449","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1017449"},{"name":"32495","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/32495"},{"name":"21792","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/21792"},{"name":"32497","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/32497"},{"name":"32499","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/32499"},{"name":"23499","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/23499"},{"name":"32494","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/32494"},{"name":"phpicalendar-multiple-scripts-xss(31146)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/31146"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2006-12-27T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in Jim Hu and Chad Little PHP iCalendar 2.23 rc1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) getdate parameter in (a) day.php, (b) month.php, (c) year.php, (d) week.php, (e) search.php, (f) rss/index.php, (g) print.php, and (h) preferences.php; the (2) cpath parameter in (i) day.php, (j) month.php, (k) year.php, (l) week.php, and (m) search.php; the (3) query parameter in search.php; and possibly the cpath, (4) unset, and (5) set parameters in a setcookie action in preferences.php; different vectors than CVE-2006-3319.  NOTE: it was later reported that vectors b, c, and d also affect 2.24."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-17T20:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"32498","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/32498"},{"name":"32493","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/32493"},{"tags":["x_refsource_MISC"],"url":"http://lostmon.blogspot.com/2006/12/php-icalendar-multiple-variable-cross.html"},{"name":"32496","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/32496"},{"name":"20071220 PHP iCalendar <= 2.24 - Cross-Site Scripting Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/485397/100/200/threaded"},{"name":"32500","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/32500"},{"name":"1017449","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1017449"},{"name":"32495","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/32495"},{"name":"21792","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/21792"},{"name":"32497","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/32497"},{"name":"32499","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/32499"},{"name":"23499","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/23499"},{"name":"32494","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/32494"},{"name":"phpicalendar-multiple-scripts-xss(31146)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/31146"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-6824","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in Jim Hu and Chad Little PHP iCalendar 2.23 rc1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) getdate parameter in (a) day.php, (b) month.php, (c) year.php, (d) week.php, (e) search.php, (f) rss/index.php, (g) print.php, and (h) preferences.php; the (2) cpath parameter in (i) day.php, (j) month.php, (k) year.php, (l) week.php, and (m) search.php; the (3) query parameter in search.php; and possibly the cpath, (4) unset, and (5) set parameters in a setcookie action in preferences.php; different vectors than CVE-2006-3319.  NOTE: it was later reported that vectors b, c, and d also affect 2.24."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"32498","refsource":"OSVDB","url":"http://www.osvdb.org/32498"},{"name":"32493","refsource":"OSVDB","url":"http://www.osvdb.org/32493"},{"name":"http://lostmon.blogspot.com/2006/12/php-icalendar-multiple-variable-cross.html","refsource":"MISC","url":"http://lostmon.blogspot.com/2006/12/php-icalendar-multiple-variable-cross.html"},{"name":"32496","refsource":"OSVDB","url":"http://www.osvdb.org/32496"},{"name":"20071220 PHP iCalendar <= 2.24 - Cross-Site Scripting Vulnerability","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/485397/100/200/threaded"},{"name":"32500","refsource":"OSVDB","url":"http://www.osvdb.org/32500"},{"name":"1017449","refsource":"SECTRACK","url":"http://securitytracker.com/id?1017449"},{"name":"32495","refsource":"OSVDB","url":"http://www.osvdb.org/32495"},{"name":"21792","refsource":"BID","url":"http://www.securityfocus.com/bid/21792"},{"name":"32497","refsource":"OSVDB","url":"http://www.osvdb.org/32497"},{"name":"32499","refsource":"OSVDB","url":"http://www.osvdb.org/32499"},{"name":"23499","refsource":"SECUNIA","url":"http://secunia.com/advisories/23499"},{"name":"32494","refsource":"OSVDB","url":"http://www.osvdb.org/32494"},{"name":"phpicalendar-multiple-scripts-xss(31146)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/31146"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2006-6824","datePublished":"2006-12-29T11:00:00.000Z","dateReserved":"2006-12-29T00:00:00.000Z","dateUpdated":"2024-08-07T20:42:07.358Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2006-12-29 11:28:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:php_icalendar:php_icalendar:*:*:*:*:*:*:*:*","versionEndIncluding":"2.23_rc1","matchCriteriaId":"BD41E0B7-1DBD-4EAE-B60A-8ECD2C8B7BA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:php_icalendar:php_icalendar:1.1:*:*:*:*:*:*:*","matchCriteriaId":"314ED0FD-8DAA-4767-A0C9-CDAEB12327FE"},{"vulnerable":true,"criteria":"cpe:2.3:a:php_icalendar:php_icalendar:2.2_beta:*:*:*:*:*:*:*","matchCriteriaId":"A5084D66-ACB9-412D-9A1F-F6614C976414"},{"vulnerable":true,"criteria":"cpe:2.3:a:php_icalendar:php_icalendar:2.22:*:*:*:*:*:*:*","matchCriteriaId":"AFC0CDA8-0820-429E-9487-C2001EA4D295"},{"vulnerable":true,"criteria":"cpe:2.3:a:php_icalendar:php_icalendar:2.24:*:*:*:*:*:*:*","matchCriteriaId":"5B71AC2C-3F84-4FE3-B474-CAFC03DD5A6E"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"6824","Ordinal":"1","Title":"CVE-2006-6824","CVE":"CVE-2006-6824","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"6824","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in Jim Hu and Chad Little PHP iCalendar 2.23 rc1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) getdate parameter in (a) day.php, (b) month.php, (c) year.php, (d) week.php, (e) search.php, (f) rss/index.php, (g) print.php, and (h) preferences.php; the (2) cpath parameter in (i) day.php, (j) month.php, (k) year.php, (l) week.php, and (m) search.php; the (3) query parameter in search.php; and possibly the cpath, (4) unset, and (5) set parameters in a setcookie action in preferences.php; different vectors than CVE-2006-3319.  NOTE: it was later reported that vectors b, c, and d also affect 2.24.","Type":"Description","Title":"CVE-2006-6824"},{"CveYear":"2006","CveId":"6824","Ordinal":"2","NoteData":"2006-12-29","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"6824","Ordinal":"3","NoteData":"2018-10-17","Type":"Other","Title":"Modified"}]}}}