CVE-2007-6274: Multiple cross-site scripting (XSS) vulnerabilities in modules/ecal/display.php in the Event Calendar in bc...

Security readout for executives and security teams

This is a legacy web application XSS issue in the bcoos Event Calendar. A remote attacker could cause a vulnerable page to return attacker-controlled script or HTML through calendar date parameters. Business impact depends on whether any public or authenticated bcoos 1.0.10 or earlier instance remains in use. Exposure is likely limited to organizations still operating bcoos 1.0.10 or earlier with the Event Calendar module reachable by users or the internet. Modern environments are unlikely to be affected unless this legacy application remains deployed. Treat this as a legacy exposure cleanup item. It becomes urgent if bcoos is internet-facing, handles authenticated sessions, or is used by privileged staff. Otherwise, prioritize discovery and retirement planning. Mitigation focus: Inventory any bcoos deployments and confirm version and Event Calendar usage.; Check vendor or maintainer guidance for fixed versions or official remediation.; Disable or restrict the Event Calendar module if it is not required..

Prepared

Jun 28, 2026, 19:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.