CVE-2007-3182: Multiple cross-site scripting (XSS) vulnerabilities in Calendarix 0.7.20070307, when register_globals is en...

Security readout for executives and security teams

Calendarix 0.7.20070307 can reflect attacker-supplied script or HTML when PHP register_globals is enabled. Affected public calendar pages could run unwanted script in a visitor's browser, creating phishing, session-theft, or content-tampering risk. The public bundle does not provide CVSS, a vendor patch, or active-exploitation evidence. Exposure is most likely on legacy PHP sites still running Calendarix 0.7.20070307 with register_globals enabled and reachable calendar pages. Modern PHP environments removed register_globals, so current exposure should be uncommon, but old hosted applications and archived intranet deployments should be checked. Prioritize discovery over emergency response. This is an old XSS issue with no active-exploitation evidence in the provided sources, but exposed legacy PHP apps can still create user-trust and account-risk problems. Remediate or retire affected deployments during the next web-app hygiene cycle. Mitigation focus: Identify and retire any Calendarix 0.7.20070307 deployments where possible.; Disable PHP register_globals if present in the hosting environment.; Check Calendarix or maintainer guidance for any fixed release or official workaround..

Prepared

Jun 29, 2026, 05:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.