CVE-2022-4455: php-calendar Cross-site Scripting
CVSS: 6.1v3.1MediumModified
AliasesCGA-22mv-m9jm-3pm9CGA-2hqw-qvjm-rw87CGA-2pjc-5v2g-2rp6CGA-3wcm-5cg3-vxqwCGA-4crc-8833-3hwfCGA-6p95-7cwj-wvf2CGA-7fgh-g8rg-4h3fCGA-886v-957v-6vwjCGA-9h2v-9gvh-w3jxCGA-9xx9-2xr2-f3rcCGA-f2xv-cphw-wp2rCGA-m2v8-p6xc-9qh6CGA-mh84-p34p-8p77CGA-qm3v-mvxc-2rfgCGA-vrgf-3rrv-3jc9CGA-w5cc-rpx4-9wrh
Published 13-12-2022Last modified 15-12-2025
Vulnerability summary
CVE-2022-4455 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in php-calendar. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 48.7% of scored vulnerabilities.
CVSS score
6.1/10
010
Medium · v3.1 (NVD)EPSS score
0.62%
0%100%
Low · +0.05 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 4Timeline
- 13-12-2022PublishedVulnerability first disclosed.
- 15-12-2025Last modifiedVulnerability information updated.
Description
A vulnerability was identified in sproctor php-calendar up to 2.0.13. This impacts an unknown function of the file index.php. Such manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be launched remotely. The name of the patch is a2941109b42201c19733127ced763e270a357809. It is advisable to implement a patch to correct this issue.
CVSS metrics
9 scores · 4 sources · 4 versionsMedium 5.1Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:XSourcesAll 4 agree
- OSV · WolfiEcosystem advisory · calculated5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X
- OSV · ChainguardEcosystem advisory · calculated5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X
- NVDNIST5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Medium 6.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NSources2 sources · 3.5–6.1
- CVE.orgCNA3.5LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:CDiffers
Low 3.5Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:CSourcesSingle source
Medium 4.0Preferred score · CVE.org (CNA)
AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:OF/RC:CSourcesAll 2 agree
- NVDNIST4.0MediumAV:N/AC:L/Au:S/C:N/I:P/A:N
EPSS trend
Probability
0.62%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
+0.05 pp
From 0.57% on 20-09-2026
20-09-202620-10-2026
EPSS score0.62%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Affected systems
Chainguard8 products
- php-8.1All versions (No fix recorded)
- php-8.1-calendarAll versions (No fix recorded)
- php-8.2All versions (No fix recorded)
- php-8.2-calendarAll versions (No fix recorded)
- php-8.3All versions (No fix recorded)
Wolfi8 products
- php-8.1All versions (No fix recorded)
- php-8.1-calendarAll versions (No fix recorded)
- php-8.2All versions (No fix recorded)
- php-8.2-calendarAll versions (No fix recorded)
- php-8.3All versions (No fix recorded)
Php-calendar1 product
- php-calendar< 2022-04-28
Sproctor1 product
- php-calendar2.0.0 | 2.0.1 | 2.0.2 | 2.0.3 | 2.0.4 | 2.0.5 | 2.0.6 | 2.0.7 | 2.0.8 | 2.0.9 | 2.0.10 | 2.0.11 | 2.0.12 | 2.0.13
4 vendors · 18 products
References
5 links- github.com/sproctor/php-calendar/commit/a2941109b42201c19733127ced763e270a357809PatchFIXThird Party Advisory
