1. Home
  2. CVE Database
  3. CVE-2025-65091
CRITICAL · 10.0

CVE-2025-65091

XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.5, users with the right to view the Calendar.JSONService page (including guest users) can exploit a SQL i...

Vulnerability Description

XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.5, users with the right to view the Calendar.JSONService page (including guest users) can exploit a SQL injection vulnerability by accessing database info or starting a DoS attack. This issue has been patched in version 2.4.5.

CVSS Score

10.0

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
XwikiFull Calendar Macro< 2.4.5

Related Weaknesses (CWE)

CWE-89

References

FAQ

What is CVE-2025-65091?

CVE-2025-65091 is a vulnerability with a CVSS score of 10.0 (CRITICAL). XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.5, users with the right to view the Calendar.JSONService page (including guest users) can exploit a SQL i...

How severe is CVE-2025-65091?

CVE-2025-65091 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2025-65091?

Check the references section above for vendor advisories and patch information. Affected products include: Xwiki Full Calendar Macro.