Full Calendar Macro

2 CVEs product

Monthly

Sort: Newest CVSS Score EPSS Score Oldest

CVE-2025-65091 Jan 10, 04:16 Maven CRITICAL PATCH Act Now

XWiki Full Calendar Macro (before 2.4.5) has SQL injection accessible to guest users via the Calendar.JSONService page. Maximum CVSS 10.0 with scope change. Patch available.

Denial Of Service SQLi Full Calendar Macro Xwiki

NVD GitHub

CVSS 3.1

10.0

EPSS

0.2%

CVE-2025-65090 Jan 10, 04:16 Maven MEDIUM PATCH This Month

XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.6, users with the rights to view the Calendar.JSONService page (including guest users) can exploit the data leak vulnerability by accessing database info, with the exception of passwords. [CVSS 5.3 MEDIUM]

Information Disclosure Full Calendar Macro Xwiki

NVD GitHub

CVSS 3.1

5.3

EPSS

0.0%

CVE-2025-65091 Maven

EPSS 0% CVSS 10.0

CRITICAL PATCH Act Now

XWiki Full Calendar Macro (before 2.4.5) has SQL injection accessible to guest users via the Calendar.JSONService page. Maximum CVSS 10.0 with scope change. Patch available.

Denial Of Service SQLi Full Calendar Macro +1

NVD GitHub

CVE-2025-65090 Maven

EPSS 0% CVSS 5.3

MEDIUM PATCH This Month

Information Disclosure Full Calendar Macro Xwiki

NVD GitHub