CVE-2005-2717: PHP remote file inclusion vulnerability in WebCalendar before 1.0.1 allows remote attackers to execute arbi...

Security readout for executives and security teams

WebCalendar before 1.0.1 allowed attackers to include a remote PHP file when certain scripts opened settings.php. If a vulnerable calendar was reachable, this could let an attacker run PHP code on the web server. The bundle provides no CVSS data or current exploitation evidence. Exposure is most likely in legacy WebCalendar deployments older than 1.0.1, especially if the application is internet-facing or packaged from old distributions. Modern exposure depends on whether WebCalendar is still deployed and reachable; the bundle does not identify supported current products or CPEs. Prioritize remediation if any WebCalendar instance is still exposed. The potential impact is server-side code execution, but business urgency depends on whether this legacy software exists in the environment and whether it is reachable from untrusted networks. Mitigation focus: Upgrade WebCalendar to 1.0.1 or later where applicable.; Apply relevant vendor or distribution security updates, including Debian guidance if used.; Remove or isolate obsolete WebCalendar deployments that cannot be updated..

Prepared

Jun 29, 2026, 18:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.