CVE-2025-25222

CRITICAL

9.8

Description

The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in retrieve.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published2/18/2025

Last Modified9/15/2025

Sourcenvd

Honeypot Sightings0

Affected Products

luxsoft:luxcal_web_calendar

Weaknesses (CWE)

CWE-89

References

https://jvn.jp/en/jp/JVN26024080/(vultures@jpcert.or.jp)

https://www.luxsoft.eu/?download(vultures@jpcert.or.jp)

https://www.luxsoft.eu/lcforum/viewtopic.php?pid=1984#p1984(vultures@jpcert.or.jp)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.