This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] XWiki Full Calendar macro fixes 2 vulnerabilities
XWiki fixes 2 vulnerabilities in the Full Calendar macro with version 2.4.6 [1][2].
Due to an SQL injection vulnerability in the Full Calendar macro, an unauthenticated remote attacker with permission to view the Calendar.JSONService page can gain full access to the information in the database or perform a DoS attack [1].
The vulnerability is present in product:
- macro-fullcalendar; <2.4.5
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2025-65091 at cve.org, NVD
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 10. 1. 2026.
Due to a vulnerability in the Full Calendar macro, an unauthenticated remote attacker with permission to view the Calendar.JSONService page can obtain users' email addresses from the database [2].
The vulnerability is present in product:
- macro-fullcalendar; <= 2.4.5
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
More information:
- CVE-2025-65090 at cve.org, NVD
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor at cwe.mitre.org
The vulnerability was publicly disclosed 10. 1. 2026.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 13. 1. 2026.