CVE-2009-4928: PHP remote file inclusion vulnerability in config.php in TotalCalendar 2.4 allows remote attackers to execu...

Security readout for executives and security teams

CVE-2009-4928 is a remote file inclusion issue in TotalCalendar 2.4. If the vulnerable PHP file is reachable, an attacker could make the application load remote PHP and run attacker-controlled code. Sources do not provide a vendor patch or current exploitation evidence. Exposure is most likely in legacy internet-facing TotalCalendar 2.4 deployments where config.php is publicly reachable. Organizations without this product, or with the file removed or inaccessible, are unlikely to be affected. Treat as a high-priority legacy web application risk if TotalCalendar 2.4 is present. The business concern is server compromise through old PHP code, not broad enterprise software exposure. Mitigation focus: Identify and retire or replace any TotalCalendar 2.4 installations.; Restrict public access to vulnerable config.php where removal is not immediate.; Check vendor or project guidance before assuming any patch exists..

Prepared

Jun 28, 2026, 02:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.