CVE-2006-3684: PHP remote file inclusion vulnerability in calendar.php in SoftComplex PHP Event Calendar 1.4 allows remote...

Security readout for executives and security teams

This is an old remote file inclusion issue in SoftComplex PHP Event Calendar 1.4. If the vulnerable calendar.php file is exposed, an attacker could make the application run attacker-controlled PHP code. The source bundle does not provide CVSS, a confirmed patch, or active exploitation evidence. Exposure is most likely on legacy PHP sites still hosting SoftComplex PHP Event Calendar 1.4, especially if calendar.php is publicly reachable. Modern environments are unlikely affected unless this old component remains embedded or copied into custom code. Prioritize if any internet-facing legacy PHP site still uses this calendar component. The business risk is full server-side code execution, but urgency depends on whether the old software is actually present and reachable. Mitigation focus: Identify and remove SoftComplex PHP Event Calendar 1.4 deployments.; Restrict public access to vulnerable calendar.php until remediation is confirmed.; Check vendor or trusted archival guidance for fixed versions or replacement advice..

Prepared

Jun 29, 2026, 11:25 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.