CVE-2006-0183: Direct static code injection vulnerability in edit.php in ACal Calendar Project 2.2.5 allows authenticated...

Security readout for executives and security teams

ACal Calendar Project 2.2.5 let authenticated users change PHP files used for the site header or footer. If abused, that could turn a calendar account into server-side code execution. The sources do not name a current patch, and CVE notes uncertainty because the issue may depend on weak authentication in CVE-2006-0182. Exposure is likely limited to organizations still running ACal Calendar Project 2.2.5, especially if its admin or edit interface is reachable by untrusted users. Source metadata does not identify other affected products or versions. Prioritize remediation if ACal 2.2.5 is still deployed on a reachable server. The business risk is server compromise through a legacy application, but urgency depends on whether the product exists in your environment and who can access its editing interface. Mitigation focus: Identify any deployed ACal Calendar Project 2.2.5 instances.; Check vendor or maintainer guidance for a fixed release or official workaround.; Restrict ACal administrative access to trusted users and management networks..

Prepared

Jun 29, 2026, 15:05 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.