What is the CVSS score of CVE-2025-21035?

CVE-2025-21035 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Calendar are affected by CVE-2025-21035?

Organizations using Samsung Calendar should be aware of moderate risk from CVE-2025-21035 rated CVSS 4.6. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2025-21035?

During next maintenance window: Identify affected systems running Samsung Calendar and apply vendor patches when convenient. Monitor vendor channels for patch availability.

Calendar CVE-2025-21035

MEDIUM

2025-09-03 mobile.security@samsung.com

Samsung Information Disclosure Calendar Android

4.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.6 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:10 vuln.today

CVE Published

Sep 03, 2025 - 06:15 nvd

MEDIUM 4.6

DescriptionCVE.org

Improper access control in Samsung Calendar prior to version 12.5.06.5 in Android 14 and 12.6.01.12 in Android 15 allows physical attackers to access data across multiple user profiles.

AnalysisAI

Improper access control in Samsung Calendar prior to version 12.5.06.5 in Android 14 and 12.6.01.12 in Android 15 allows physical attackers to access data across multiple user profiles. Rated medium severity (CVSS 4.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

Improper access control in Samsung Calendar prior to version 12.5.06.5 in Android 14 and 12.6.01.12 in Android 15 allows physical attackers to access data across multiple user profiles. Affected products include: Samsung Calendar. Version information: version 12.5.06.5.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Calendar

View all

CVE-2026-14827 MEDIUM This Month POC

6.8 Jul 27

Stored cross-site scripting (XSS) in the Calendar WordPress plugin prior to version 1.3.18 allows authenticated users wi

CVE-2022-24838 CRITICAL Act Now

9.8 Apr 11

Nextcloud Calendar is a calendar application for the nextcloud framework. Rated critical severity (CVSS 9.8), this vulne

CVE-2019-11829 CRITICAL Act Now

9.8 Jun 30

OS command injection vulnerability in drivers_syno_import_user.php in Synology Calendar before 2.3.1-0617 allows remote

CVE-2025-66550 MEDIUM This Month POC

5.7 Dec 05

A security vulnerability in Nextcloud Calendar (CVSS 5.7). Risk factors: public PoC available. Vendor patch is available

CVE-2023-45150 MEDIUM This Month POC

4.3 Oct 16

Nextcloud calendar is a calendar app for the Nextcloud server platform. Rated medium severity (CVSS 4.3), this vulnerabi

CVE-2022-22686 HIGH This Week

8.0 Jul 26

Cross-Site Request Forgery (CSRF) vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote

CVE-2021-34812 HIGH This Week

7.5 Jun 18

Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attack

CVE-2013-2698 MEDIUM This Month

6.8 May 27

Cross-site request forgery (CSRF) vulnerability in the Calendar plugin before 1.3.3 for WordPress allows remote attacker

CVE-2017-15891 MEDIUM This Month

6.5 Dec 08

Improper access control vulnerability in SYNO.Cal.EventBase in Synology Calendar before 2.0.1-0242 allows remote authent

CVE-2023-48308 MEDIUM This Month

6.5 Dec 22

Nextcloud/Cloud is a calendar app for Nextcloud. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploi

CVE-2018-8927 MEDIUM This Month

6.5 Jun 14

Improper authorization vulnerability in SYNO.Cal.Event in Calendar before 2.1.2-0511 allows remote authenticated users t

CVE-2026-29052 MEDIUM This Month

6.1 Mar 05

HumHub Calendar module versions prior to 1.8.11 contain a stored XSS vulnerability in Event Types that allows attackers

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2025-21035 vulnerability details – vuln.today

Back

Calendar CVE-2025-21035

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Calendar

Same technique Information Disclosure

Share

External POC / Exploit Code