Skip to main content

Calendar EUVDEUVD-2025-201443

| CVE-2025-66550 MEDIUM
Improper Handling of Unexpected Data Type (CWE-241)
2025-12-05 security-advisories@github.com
Information Disclosure Calendar Nextcloud
5.7
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
5.7 MEDIUM
AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

5
EUVD ID Assigned
Mar 15, 2026 - 17:08 euvd
EUVD-2025-201443
Analysis Generated
Mar 15, 2026 - 17:08 vuln.today
Patch released
Mar 15, 2026 - 17:08 nvd
Patch available
PoC Detected
Dec 10, 2025 - 14:13 vuln.today
Public exploit code
CVE Published
Dec 05, 2025 - 17:16 nvd
MEDIUM 5.7

DescriptionGitHub Advisory

Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachment that links to a download link of a file on the same Nextcloud server, the file would be downloaded without the user confirming the action. This vulnerability is fixed in 4.7.17 and 5.2.4.

AnalysisAI

A security vulnerability in Nextcloud Calendar (CVSS 5.7). Risk factors: public PoC available. Vendor patch is available.

Technical ContextAI

Vulnerability type not specified by vendor. Affects Nextcloud Calendar.

RemediationAI

Apply the vendor-supplied patch immediately.

More in Calendar

View all
CVE-2026-14827 MEDIUM POC
6.8 Jul 27

Stored cross-site scripting (XSS) in the Calendar WordPress plugin prior to version 1.3.18 allows authenticated users wi
CVE-2022-24838 CRITICAL
9.8 Apr 11

Nextcloud Calendar is a calendar application for the nextcloud framework. Rated critical severity (CVSS 9.8), this vulne
CVE-2019-11829 CRITICAL
9.8 Jun 30

OS command injection vulnerability in drivers_syno_import_user.php in Synology Calendar before 2.3.1-0617 allows remote

CVE-2023-45150 MEDIUM POC
4.3 Oct 16

Nextcloud calendar is a calendar app for the Nextcloud server platform. Rated medium severity (CVSS 4.3), this vulnerabi
CVE-2022-22686 HIGH
8.0 Jul 26

Cross-Site Request Forgery (CSRF) vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote
CVE-2021-34812 HIGH
7.5 Jun 18

Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attack
CVE-2013-2698 MEDIUM
6.8 May 27

Cross-site request forgery (CSRF) vulnerability in the Calendar plugin before 1.3.3 for WordPress allows remote attacker
CVE-2017-15891 MEDIUM
6.5 Dec 08

Improper access control vulnerability in SYNO.Cal.EventBase in Synology Calendar before 2.0.1-0242 allows remote authent
CVE-2023-48308 MEDIUM
6.5 Dec 22

Nextcloud/Cloud is a calendar app for Nextcloud. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploi
CVE-2018-8927 MEDIUM
6.5 Jun 14

Improper authorization vulnerability in SYNO.Cal.Event in Calendar before 2.1.2-0511 allows remote authenticated users t
CVE-2026-29052 MEDIUM
6.1 Mar 05

HumHub Calendar module versions prior to 1.8.11 contain a stored XSS vulnerability in Event Types that allows attackers

CVE-2024-45303 MEDIUM
6.1 Sep 12

Discourse Calendar plugin adds the ability to create a dynamic calendar in the first post of a topic to Discourse. Rated

Same weakness CWE-241 – Improper Handling of Unexpected Data Type

View all
CVE-2022-29181 HIGH POC
8.2
CVE-2021-39131 HIGH POC
7.5
CVE-2023-5215 MEDIUM POC
6.5
CVE-2022-39064 HIGH
8.1
CVE-2021-40116 HIGH
7.5
CVE-2022-20730 HIGH
7.5
CVE-2024-25966 HIGH
7.5
CVE-2023-30591 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2025-201443 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy