CVE-2006-7196: Apache Tomcat calendar example XSS via time parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityThe flaw is a reflected XSS in a sample application with no known in-the-wild exploitation, but the very high EPSS score and wide historical Tomcat deployment warrant prompt remediation.

What it is

The calendar example application shipped with Apache Tomcat 4.0.x, 4.1.x, 5.0.x and 5.5.x fails to sanitize the time parameter passed to cal2.jsp, allowing reflected cross-site scripting. Because the vulnerable code is a sample application bundled with the server, any deployment that leaves the examples webapp reachable is exposed to script injection in a victim's browser.

Impact

An attacker can execute arbitrary script in the context of the Tomcat host, enabling session theft, credential phishing or defacement of the affected page. The CVSS vector shows no confidentiality or availability impact, only partial integrity impact.

Attack surface

Reachable remotely over HTTP by sending a crafted time parameter to cal2.jsp; no authentication is required and the victim must be induced to follow a link or load attacker-controlled content. The description notes other unspecified vectors may also exist.

Exploitation

Not listed in CISA KEV and no reference carries an exploit tag, but EPSS is 0.72168 (99.4th percentile), indicating a high modeled likelihood of exploitation activity.

What to do

• Upgrade Tomcat to a release outside the affected 4.0.x, 4.1.x, 5.0.x and 5.5.x ranges, or apply the vendor fixes referenced in the Apache Tomcat security pages for versions 4 and 5.
• Remove or disable the bundled examples webapp (including cal2.jsp) from production Tomcat instances.
• Apply input validation and output encoding to the time parameter if the calendar example must remain deployed.
• Restrict network access to Tomcat management and example endpoints to trusted networks only.

Detection

• Search HTTP access logs for requests to cal2.jsp containing script-like characters or encoded payloads in the time parameter.
• Alert on any access to the examples webapp paths on production Tomcat servers.
• Review web application firewall or proxy logs for reflected XSS patterns targeting cal2.jsp.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.