Back to Database
Status published
Critical
CVE-2025-65091
XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService
Vulnerability Description
XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.5, users with the right to view the Calendar.JSONService page (including guest users) can exploit a SQL injection vulnerability by accessing database info or starting a DoS attack. This issue has been patched in version 2.4.5.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-65091
Credits & Attribution
No credits recorded in the NVD database.
References
More from xwiki-contrib
View All →CVE-2025-66024
XWiki Blog Application home page vulnerable to Stored XSS via Post Title
High
8.6
CVE-2025-65090
XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService
Medium
5.3
CVE-2025-58365
XWiki Blog Application: Privilege Escalation (PR) from account through blog content
High
8.7
CVE-2025-52133
The Mocca Calendar application before 2.15 for XWiki allows XSS...
Medium
6.4
CVE-2025-52132
The Mocca Calendar application before 2.15 for XWiki allows XSS...
Medium
6.4
Affected Vendor
xwiki-contrib
View all reports →Affected Software
macro-fullcalendar
Vulnerable Versions:
< 2.4.5
Timeline
Official Publish:
January 10th, 2026
Last Modified:
January 12th, 2026
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H