CVE-2025-65091: XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.5, users with the right to view the Calendar.JSONService page…

PriorityP263critical10CVSS 3.1

AVNACLPRNUINSCCHIHAH

EPSS

0.28%

19.9th percentile

XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.5, users with the right to view the Calendar.JSONService page (including guest users) can exploit a SQL injection vulnerability by accessing database info or starting a DoS attack. This issue has been patched in version 2.4.5.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
xwiki-contrib	macro-fullcalendar	< 2.4.5	2.4.5
xwiki	full_calendar_macro	< 2.4.5	2.4.5

Detection & IOCsextracted from sources · hover to see the quote

→The vulnerable endpoint is the `Calendar.JSONService` page in XWiki Full Calendar Macro; monitor for unexpected or unauthenticated HTTP requests to this page, which may indicate SQL injection probing or DoS attempts. ↗

·The vulnerability affects `org.xwiki.contrib:macro-fullcalendar-pom` prior to version 2.4.5; ensure the patched version 2.4.5 or later is deployed. ↗
·Guest (unauthenticated) users are able to reach the vulnerable Calendar.JSONService page, meaning no authentication is required to exploit this SQL injection — access controls on this page should be reviewed even before patching. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.