Most recent entries from all

EUVD-2026-218072

fkie_cve-2025-25222

The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in retrieve.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved.

GHSA-2jpm-37j9-vp2m

jvndb-2025-000012

The LuxCal Web Calendar provided by LuxSoft contains multiple vulnerabilities listed below. <ul><li>SQL injection in pdf.php (CWE-89) - CVE-2025-25221</li> <li>SQL injection in retrieve.php (CWE-89) - CVE-2025-25222</li> <li>Path traversal in dloader.php (CWE-22) - CVE-2025-25223</li> <li>Missing authentication in dloader.php (CWE-306) - CVE-2025-25224</li></ul> CVE-2025-25221, CVE-2025-25222 Rikuto Tauchi reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2025-25223, CVE-2025-25224 Yuji Tounai of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.