CVE-2006-3684
PHP remote file inclusion vulnerability in calendar.php in SoftComplex PHP Event Calendar 1.4...
PHP remote file inclusion vulnerability in calendar.php in SoftComplex PHP Event Calendar 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_calendar parameter, which overwrites the $path_to_calendar variable from an extract function call.
Exploit likelihood
What each source reports
NVD Score used
PHP remote file inclusion vulnerability in calendar.php in SoftComplex PHP Event Calendar 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_calendar parameter, which overwrites the $path_to_calendar variable from an extract function call.
- Record
CVE-2006-3684- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
PHP remote file inclusion vulnerability in calendar.php in SoftComplex PHP Event Calendar 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_calendar parameter, which overwrites the $path_to_calendar variable from an extract function call.
- Record
CVE-2006-3684- Updated
- 2026-11-02
EUVDEUVD-2006-3679 No score
PHP remote file inclusion vulnerability in calendar.php in SoftComplex PHP Event Calendar 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_calendar parameter, which overwrites the $path_to_calendar variable from an extract function call.
- Record
EUVD-2006-3679- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fff7-9hc4-6xc5 No score
PHP remote file inclusion vulnerability in calendar.php in SoftComplex PHP Event Calendar 1.4...
PHP remote file inclusion vulnerability in calendar.php in SoftComplex PHP Event Calendar 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_calendar parameter, which overwrites the $path_to_calendar variable from an extract function call.
- Record
GHSA-fff7-9hc4-6xc5- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-3684 is a high vulnerability (CVSS 7.5) in Softcomplex Php Event Calendar, published July 18, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.08%, the 81st percentile. No source names a fixed version.
References
secunia.com/advisories/21074
solpotcrew.org/adv/solpot-adv-01.txt
securityfocus.com/archive/1/440265/100/0/threaded
vupen.com/english/advisories/2006/2848
exchange.xforce.ibmcloud.com/vulnerabilities/27766
nvd.nist.gov/vuln/detail/CVE-2006-3684
github.com/advisories/GHSA-fff7-9hc4-6xc5