Most recent entries from all

EUVD-2026-218068

fkie_cve-2025-25224

The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a missing authentication vulnerability in dloader.php. If this vulnerability is exploited, arbitrary files on a server may be obtained.

GHSA-f52p-4vq3-mmgf

jvndb-2025-000012

The LuxCal Web Calendar provided by LuxSoft contains multiple vulnerabilities listed below. <ul><li>SQL injection in pdf.php (CWE-89) - CVE-2025-25221</li> <li>SQL injection in retrieve.php (CWE-89) - CVE-2025-25222</li> <li>Path traversal in dloader.php (CWE-22) - CVE-2025-25223</li> <li>Missing authentication in dloader.php (CWE-306) - CVE-2025-25224</li></ul> CVE-2025-25221, CVE-2025-25222 Rikuto Tauchi reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2025-25223, CVE-2025-25224 Yuji Tounai of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.