Cross-site scripting (XSS) vulnerability in calmake.pl in ACME PerlCal 2.99.20 allows remote attackers to inject arbitrary web script or HTML via the p0 parameter.
Directory traversal vulnerability in calmake.pl in PerlCal allows remote attackers to read arbitrary files via a .. (dot dot) in the p0 parameter.