What’s Vulnerable › Vulnerabilities

CVE-2025-65091: XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService

• Severity: critical (CVSS 10.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-10 · updated 2026-06-17
• Weakness: CWE-89

Description

XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.5, users with the right to view the Calendar.JSONService page (including guest users) can exploit a SQL injection vulnerability by accessing database info or starting a DoS attack. This issue has been patched in version 2.4.5.

Affected products

• xwiki-contrib macro-fullcalendar: before 2.4.5 — fixed in 2.4.5

How to fix

Upgrade to a fixed version: xwiki-contrib macro-fullcalendar 2.4.5. Check the vendor advisory for mitigations.

References

• https://github.com/xwiki-contrib/macro-fullcalendar/commit/5fdcf06a05015786492fda69b4d9dea5460cc994
• https://github.com/xwiki-contrib/macro-fullcalendar/security/advisories/GHSA-2g22-wg49-fgv5

Get alerted when CVE-2025-65091 or the next vulnerability affects your stack