Paper/Archive/CVE-2025-25221

CVE-2025-25221

LuxSoft The LuxCal Web Calendar — The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in p…

EPSS 0.5%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 41.1.411 × 208.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in pdf.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved.

Affected

ProductAffectedFixed inSource

The LuxCal Web Calendarprior to 5.3.3M (MySQL version)–CNA

The LuxCal Web Calendarprior to 5.3.3L (SQLite version)–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

jpcert (CNA)7.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refluxsoft.eu/?download refluxsoft.eu/lcforum/viewtopic.php?pid=1984#p1984 refjvn.jp/en/jp/JVN26024080