CVE-2006-7196: Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through...

Security readout for executives and security teams

This is an old cross-site scripting issue in Apache Tomcat's bundled calendar example application. If that sample app is still exposed, an attacker could cause a user's browser to run attacker-supplied script. Business urgency is mainly for legacy Tomcat systems where examples were deployed publicly. Exposure is most likely on legacy Tomcat deployments that left the example calendar application installed and reachable. Modern systems, systems without the example app, or systems no longer running the listed branches are less likely exposed. Prioritize discovery over emergency response. This is a legacy XSS risk with no supplied active-exploitation evidence, but public-facing sample applications on obsolete Tomcat should be removed or upgraded quickly because they are unnecessary exposure. Mitigation focus: Remove or disable the Tomcat example calendar application if not required.; Upgrade away from the listed affected Tomcat versions.; Check Apache Tomcat security pages for version-specific vendor guidance..

Prepared

Jun 29, 2026, 05:42 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.