CVE-2006-1401: Multiple cross-site scripting (XSS) vulnerabilities in search.php in Calendar Express 2.2 allow remote atta...

Security readout for executives and security teams

Calendar Express 2.2 reportedly has cross-site scripting in its search page. An attacker could cause a user’s browser to run unwanted script through search parameters. The CVE record says the details come from third-party information and provenance is unknown, so urgency depends on whether this old product is still deployed. Exposure is likely limited to organizations still running Calendar Express 2.2, especially if search.php is reachable by untrusted users. The provided affected-product metadata is incomplete and lists vendor/product/version as n/a, so inventory validation is required. Prioritize confirmation over emergency response. If the product is absent, no action is needed beyond documentation. If present and public-facing, treat it as a legacy web risk and plan containment or replacement because the source bundle does not identify a patch. Mitigation focus: Inventory for Calendar Express 2.2 and any reachable search.php endpoints.; Check vendor or archive guidance for a fixed release or patch.; If unsupported, replace, retire, or isolate the application..

Prepared

Jun 29, 2026, 13:35 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.