CVE-2025-65091

Description

XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.5, users with the right to view the Calendar.JSONService page (including guest users) can exploit a SQL injection vulnerability by accessing database info or starting a DoS attack. This issue has been patched in version 2.4.5.

Risk Information

Base Score

10.0

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.201

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2025-65091 are fixed in XWiki - macro-fullcalendar-pom 2.4.5	Windows
Vulnerabilities CVE-2025-65091 are fixed in XWiki - macro-fullcalendar-pom for Linux 2.4.5	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234