A security hole has been identified in phpicalendar 2.2 which may affect some earlier versions after 2.0. A patch is described on the forum at http://phpicalendar.net/forums/viewtopic.php?t=396
A patched file has been uploaded to CVS, and a new release will be prepared soon.