CVE-2006-6634: Multiple PHP remote file inclusion vulnerabilities in the ExtCalThai (com_extcalendar) 0.9.1 and earlier co...

Security readout for executives and security teams

This CVE affects an old Mambo calendar component, ExtCalThai/com_extcalendar 0.9.1 and earlier. Publicly reachable installations could let a remote attacker make the server load attacker-controlled PHP, leading to arbitrary code execution. The sources do not provide CVSS, a patch version, or evidence of active exploitation. Exposure is limited to legacy Mambo sites running ExtCalThai/com_extcalendar 0.9.1 or earlier. The source bundle provides no CPEs or vendor-maintained affected-product metadata, so asset validation must come from installed component names, paths, and version evidence. Treat this as high priority only if legacy Mambo assets are still internet-facing. If no Mambo or ExtCalThai deployments exist, business exposure is likely low. The main risk is full compromise of an outdated public PHP application. Mitigation focus: Identify public Mambo sites running ExtCalThai or com_extcalendar.; Check vendor or project guidance for a fixed release; sources do not name a patch.; Remove or disable com_extcalendar where it is not required..

Prepared

Jun 29, 2026, 08:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.