CVE-2006-7055: PHP remote file inclusion vulnerability in index.php in TotalCalendar 2.30 and earlier allows remote attack...

Security readout for executives and security teams

TotalCalendar 2.30 and earlier has a remote file inclusion flaw that can let an attacker make the application load attacker-controlled PHP code. If an old public TotalCalendar install is still reachable, compromise could mean full control of that web application and possibly the hosting account. Exposure is most likely in legacy PHP websites that still run SweetPHP TotalCalendar 2.30 or earlier, especially if index.php is internet-accessible. Modern environments are unlikely to be affected unless they retain this old component. Prioritize remediation when TotalCalendar is internet-facing or hosted on shared production infrastructure. This is an old, specific product issue, but the business risk is serious where present because the described impact is arbitrary code execution. Mitigation focus: Identify and retire any TotalCalendar 2.30 or earlier deployment.; Apply the vendor TotalCalendar security patch if still available and applicable.; Restrict public access to affected TotalCalendar paths until remediation is complete..

Prepared

Jun 29, 2026, 07:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.