CVE-2025-25221: The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in pdf.php. If this…

PriorityP350critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

0.44%

35.1th percentile

The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in pdf.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
luxsoft	luxcal_web_calendar	< 5.3.3l	5.3.3l
luxsoft	luxcal_web_calendar	< 5.3.3m	5.3.3m
luxsoft	the_luxcal_web_calendar	—	—
luxsoft	the_luxcal_web_calendar	—	—

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv3.07.3HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.