CVE-2025-65091 CRITICAL

CVE-2025-65091: XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService

Vendor Xwiki-Contrib

Product macro-fullcalendar

Weakness CWE-89 · SQLi

Published January 10, 2026

Last update January 12, 2026

View on NVD All CVEs

CVSS base score

10.0/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.5, users with the right to view the Calendar.JSONService page (including guest users) can exploit a SQL injection vulnerability by accessing database info or starting a DoS attack. This issue has been patched in version 2.4.5.

Key dates

02Disclosure timeline

January 10, 2026 CVE published

January 12, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-65091 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

04Related CVE

CVE-2025-11432 itsourcecode Leave Management System reset.php sql injection CVE-2023-26015 WordPress MapPress Maps for WordPress Plugin <= 2.85.4 is vulnerable to SQL Injection CVE-2026-2468 Quentn WP <= 1.2.12 - Unauthenticated SQL Injection via 'qntn_wp_access' Cookie CVE-2024-12195 WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.16 - Authenticated (Subscriber+) SQL Injection CVE-2024-6951 SourceCodester Simple Online Book Store System admin_delete.php sql injection