https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T22:02:54.367145+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-00448 bdu:2026-00448 2026-10-02T22:02:54.370217+00:00 bdu:2026-00448 https://cve.radiocsirt.org/vuln/euvd-2026-265422 EUVD-2026-265422 2026-10-02T22:02:54.370248+00:00 EUVD-2026-265422 https://cve.radiocsirt.org/vuln/fkie_cve-2025-65091 fkie_cve-2025-65091 2026-10-02T22:02:54.370262+00:00

XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.5, users with the right to view the Calendar.JSONService page (including guest users) can exploit a SQL injection vulnerability by accessing database info or starting a DoS attack. This issue has been patched in version 2.4.5.

 https://cve.radiocsirt.org/vuln/ghsa-2g22-wg49-fgv5 GHSA-2g22-wg49-fgv5 — XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService 2026-10-02T22:02:54.370292+00:00

Affected: Maven: org.xwiki.contrib:macro-fullcalendar-pom

### Impact

Anyone who has view rights on the `Calendar.JSONService` page, including guest users can exploit this vulnerability by accessing database info or starting a DoS attack.

### Workarounds

Remove the `Calendar.JSONService` page. This will however break some functionalities.

### References

Jira issue: * [FULLCAL-80: SQL injection through Calendar.JSONService](https://jira.xwiki.org/browse/FULLCAL-80) * [FULLCAL-81: SQL injection through Calendar.JSONService still exists](https://jira.xwiki.org/browse/FULLCAL-81)

### For more information

If there are any questions or comments about this advisory: * Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email [Security Mailing List](mailto:security@xwiki.org)

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0060 WID-SEC-W-2026-0060 — xwiki (Full Calendar Macro): Mehrere Schwachstellen 2026-10-02T22:02:54.370324+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in xwiki ausnutzen, um Informationen offenzulegen, eine SQL-Injection durchzuführen oder einen Denial-of-Service-Zustand zu verursachen.