http://www.alerisdata.com/articles/home.asp

There exists an SQL injection vulnerability within the calendar section of a Aleris Software Systems web publisher. It seems thats Aleris uses this same calendar with every site they make that utilizes the publisher.

http://www.example.com/calendar/page...FROM%20users--

I reported this to aleris and am awaiting a response. No fix yet.