PT-2026-1847 · Xwiki · Xwiki

Published 2025-07-04 · Updated 2026-01-15 · CVE-2025-65091

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki versions prior to 2.4.5

Description The XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.5, users with the right to view the Calendar.JSONService page, including guest users, can exploit a SQL injection vulnerability. This allows for potential access to database information or the initiation of a Denial of Service (DoS) attack. The vulnerability is present through the Calendar.JSONService endpoint. Exploitation involves SQL injection via this endpoint, potentially granting unauthorized database access.

Recommendations Versions prior to 2.4.5 should be updated to version 2.4.5.

Exploit

Fix

DoS

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2026-00448

CVE-2025-65091

GHSA-2G22-WG49-FGV5

Affected Products

Xwiki

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65091.json · Exploit
• https://github.com/xwiki-contrib/macro-fullcalendar/commit/5fdcf06a05015786492fda69b4d9dea5460cc994 · Patch
• https://osv.dev/vulnerability/CVE-2025-65091 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65091 · Security Note
• https://bdu.fstec.ru/vul/2026-00448 · Security Note
• https://osv.dev/vulnerability/GHSA-2g22-wg49-fgv5 · Vendor Advisory
• https://github.com/xwiki-contrib/macro-fullcalendar · Note
• https://github.com/xwiki-contrib/macro-fullcalendar/security/advisories/GHSA-2g22-wg49-fgv5 · Note
• https://twitter.com/cracbot/status/2011755312307716200 · Twitter Post
• https://twitter.com/TheHackerWire/status/2009852638595313884 · Twitter Post
• https://t.me/CVEtracker/41911 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2009882078930747849 · Twitter Post
• https://twitter.com/pulsepatchio/status/2009994140017406250 · Twitter Post
• https://extensions.xwiki.org/xwiki/bin/view/Extension/FullCalendar%20Application · Note
• https://twitter.com/CveFindCom/status/2009847563994775703 · Twitter Post