CVE-2022-4455

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability was identified in sproctor php-calendar up to 2.0.13. This impacts an unknown function of the file index.php. Such manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be launched remotely. The name of the patch is a2941109b42201c19733127ced763e270a357809. It is advisable to implement a patch to correct this issue.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
sproctor	php-calendar	2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; 2.0.6; 2.0.7; 2.0.8; 2.0.9; 2.0.10; 2.0.11; 2.0.12; 2.0.13

References

https://github.com/sproctor/php-calendar/commit/a2941109b42201c19733127ced763e270a357809Patch, Third Party Advisory
https://vuldb.com/?ctiid.215445
https://vuldb.com/?id.215445Third Party Advisory
https://github.com/sproctor/php-calendar/commit/a2941109b42201c19733127ced763e270a357809Patch, Third Party Advisory
https://vuldb.com/?id.215445Third Party Advisory

Timeline

Published: Dec 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-445507.5The graphics display module has a UAF vulnerability when traversing graphic layers. Successful exploitation of this vulnerability may affect CVE-2022-445519.8The iaware module has a vulnerability in thread security. Successful exploitation of this vulnerability will affect confidentiality, integri CVE-2022-445527.5The lock screen module has defects introduced in the design process. Successful exploitation of this vulnerability may affect system availab CVE-2022-445535.3The HiView module has a vulnerability of not filtering third-party apps out when the HiView module traverses to invoke the system provider. CVE-2022-445547.5The power module has a vulnerability in permission verification. Successful exploitation of this vulnerability may cause abnormal status of CVE-2022-445557.5The DDMP/ODMF module has a service hijacking vulnerability. Successful exploit of this vulnerability may cause services to be unavailable.CVE-2022-445567.5Missing parameter type validation in the DRM module. Successful exploitation of this vulnerability may affect availability.CVE-2022-445577.5The SmartTrimProcessEvent module has a vulnerability of obtaining the read and write permissions on arbitrary system files. Successful explo CVE-2022-445589.8The AMS module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privil CVE-2022-445599.8The AMS module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privil CVE-2022-44566.1A vulnerability has been found in falling-fruit and classified as problematic. This vulnerability affects unknown code. The manipulation lea CVE-2022-445605.3The launcher module has an Intent redirection vulnerability. Successful exploitation of this vulnerability may cause launcher module data to