CVE-2005-3366

PHP file inclusion vulnerability in index.php in PHP iCalendar 2.0a2 through 2.0.1 allows remote attackers to execute arbitrary PHP code and include arbitrary local files via the phpicalendar cookie. NOTE: this is not a cross-site scripting (XSS) issue as claimed by the original researcher.

• http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0512.htmlExploit, Patch, Vendor Advisory
• http://marc.info/?l=bugtraq&m=113025930517426&w=2
• http://secunia.com/advisories/17328/Vendor Advisory
• http://securityreason.com/securityalert/113
• http://securitytracker.com/id?1015102
• http://www.securityfocus.com/bid/15193
• http://www.ush.it/2005/10/25/php-icalendar-css/Exploit, Patch, Vendor Advisory
• http://www.vupen.com/english/advisories/2005/2204
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22864
• http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0512.htmlExploit, Patch, Vendor Advisory
• http://marc.info/?l=bugtraq&m=113025930517426&w=2
• http://secunia.com/advisories/17328/Vendor Advisory
• http://securityreason.com/securityalert/113
• http://securitytracker.com/id?1015102
• http://www.securityfocus.com/bid/15193
• http://www.ush.it/2005/10/25/php-icalendar-css/Exploit, Patch, Vendor Advisory
• http://www.vupen.com/english/advisories/2005/2204
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22864

Published

Oct 30, 2005

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2005-3360The installation of Trend Micro PC-Cillin Internet Security …
• CVE-2005-3361Cross-site scripting (XSS) vulnerability in forum/index.php …
• CVE-2005-3362Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2005-3363SQL injection vulnerability in Saphp Lesson, possibly saphp …
• CVE-2005-3364Multiple SQL injection vulnerabilities in DboardGear allow r…
• CVE-2005-3365Multiple SQL injection vulnerabilities in DCP-Portal 6 and e…
• CVE-2005-3367Cross-site scripting (XSS) vulnerability in journal.php in S…
• CVE-2005-3368Cross-site scripting (XSS) vulnerability in the Search_Enhan…
• CVE-2005-3369Multiple SQL injection vulnerabilities in the Info-DB module…
• CVE-2005-3370Multiple interpretation error in ArcaVir 2005 package 2005-0…
• CVE-2005-3371Multiple interpretation error in AVG 7 7.0.323 allows remote…
• CVE-2005-3372Multiple interpretation error in eTrust CA 7.0.1.4 with the …