EIP-2026-110707

The provided text describes a cross-site scripting (XSS) vulnerability in PHP iCalendar version 2.22, where user-supplied input via the 'cal' parameter is not properly sanitized. This allows arbitrary script execution in the context of the affected site.