Softcomplex · Softcomplex Php Event Calendar · CVE-2006-4825
**Name of the Vulnerable Software and Affected Versions**
SoftComplex PHP Event Calendar version 1.5.1 and possibly earlier
**Description**
The issue allows remote attackers to inject arbitrary web script or HTML via the `ti`, `bi`, or `cbgi` parameters in the cl files/index.php file. This can lead to cross-site scripting (XSS) attacks.
**Recommendations**
For SoftComplex PHP Event Calendar version 1.5.1 and possibly earlier, consider restricting access to the cl files/index.php file until a patch is available. As a temporary workaround, avoid using the `ti`, `bi`, or `cbgi` parameters in the affected file to minimize the risk of exploitation.