by Kastro
Paper/Archive/CVE-2025-25222

CVE-2025-25222

LuxSoft The LuxCal Web Calendar — The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in r…

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 41.1.411 × 208.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in retrieve.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved.

Affected

ProductAffectedFixed inSource
The LuxCal Web Calendarprior to 5.3.3M (MySQL version)–CNA
The LuxCal Web Calendarprior to 5.3.3L (SQLite version)–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
jpcert (CNA)7.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refluxsoft.eu/?downloadrefluxsoft.eu/lcforum/viewtopic.php?pid=1984#p1984refjvn.jp/en/jp/JVN26024080