CVE-2007-0681: profile.php in ExtCalendar 2 and earlier allows remote attackers to change the passwords of arbitrary users...

Security readout for executives and security teams

CVE-2007-0681 describes a flaw in ExtCalendar 2 and earlier that can let a remote attacker change another user’s password without knowing the current password. For organizations still running this old calendar software, the practical risk is account takeover and possible unauthorized administrative actions. Exposure is most likely where ExtCalendar 2 or earlier is still deployed, especially if profile or registration functionality is reachable from the internet. The provided affected metadata is incomplete, so asset validation is required. Treat as high priority only if ExtCalendar is present. The software is old, and the issue affects passwords, so exposed instances should be isolated, remediated, or retired promptly. Mitigation focus: Identify any ExtCalendar 2 or earlier deployments.; Check vendor or maintainer guidance for fixed versions or replacement paths.; Restrict external access to affected calendar functionality until resolved..

Prepared

Jun 29, 2026, 07:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.