CVE-2025-25222

The LuxCal Web Calendar prior to 5.3.3M MySQL version and prior to 5.3.3L SQLite version contains an SQL injection vulnerability in retrieve.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved...

CVE-2025-25222

The LuxCal Web Calendar prior to 5.3.3M MySQL version and prior to 5.3.3L SQLite version contains an SQL injection vulnerability in retrieve.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved...

CVE-2025-25222

CVE-2025-25222 affects LuxCal Web Calendar. Multiple connected sources confirm an SQL injection vulnerability in retrieve.php present in LuxCal versions prior to 5.3.3M (MySQL) and prior to 5.3.3L (SQLite). Root cause: unsafely constructed SQL in retrieve.php allows unauthorized access to databas...

CVE-2025-25221

The CVE-2025-25221 issue affects LuxCal Web Calendar. A SQL injection vulnerability in pdf.php impacts LuxCal versions prior to 5.3.3M (MySQL) and prior to 5.3.3L (SQLite). Exploitation could allow deletion, alteration, or retrieval of database information, per multiple connected sources. The roo...

CVE-2025-25221

The LuxCal Web Calendar prior to 5.3.3M MySQL version and prior to 5.3.3L SQLite version contains an SQL injection vulnerability in pdf.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved...

CVE-2025-25221

The LuxCal Web Calendar prior to 5.3.3M MySQL version and prior to 5.3.3L SQLite version contains an SQL injection vulnerability in pdf.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved...

LuxSoft LuxCal Web Calendar 路径遍历漏洞

LuxSoft LuxCal Web Calendar is a free user-friendly lightweight web-based event calendar from LuxSoft Switzerland. A path traversal vulnerability exists in LuxSoft LuxCal Web Calendar versions prior to 5.3.3M and prior to 5.3.3L, which stems from a path traversal issue in dloader.php that could...

LuxSoft LuxCal Web Calendar SQL注入漏洞

LuxSoft LuxCal Web Calendar is a free user-friendly lightweight web-based event calendar from LuxSoft Switzerland. A SQL injection vulnerability exists in LuxSoft LuxCal Web Calendar versions prior to 5.3.3M and prior to 5.3.3L, which originates from a SQL injection in retrieve.php and could lead...

LuxSoft LuxCal Web Calendar 访问控制错误漏洞

LuxSoft LuxCal Web Calendar is a free user-friendly lightweight web-based event calendar from LuxSoft Switzerland. An access control error vulnerability exists in LuxSoft LuxCal Web Calendar versions prior to 5.3.3M and prior to 5.3.3L, which stems from a missing authentication in dloader.php and...

Multiple vulnerabilities in The LuxCal Web Calendar

Overview The LuxCal Web Calendar provided by LuxSoft contains multiple vulnerabilities listed below. SQL injection in pdf.php CWE-89 - CVE-2025-25221 SQL injection in retrieve.php CWE-89 - CVE-2025-25222 Path traversal in dloader.php CWE-22 - CVE-2025-25223 Missing authentication in dloader.php...

PT-2025-7063 · Unknown · Luxcal Web Calendar

Name of the Vulnerable Software and Affected Versions: LuxCal Web Calendar versions prior to 5.3.3M LuxCal Web Calendar versions prior to 5.3.3L Description: The issue concerns a path traversal vulnerability in the dloader.php file. This vulnerability can be exploited to obtain arbitrary files on...

PT-2025-7061 · Unknown · Luxcal Web Calendar

Name of the Vulnerable Software and Affected Versions: LuxCal Web Calendar versions prior to 5.3.3M MySQL version LuxCal Web Calendar versions prior to 5.3.3L SQLite version Description: The issue concerns an SQL injection vulnerability in the pdf.php file. If exploited, this vulnerability may...

PT-2025-7064 · Unknown · Luxcal Web Calendar

Name of the Vulnerable Software and Affected Versions: LuxCal Web Calendar versions prior to 5.3.3M MySQL version LuxCal Web Calendar versions prior to 5.3.3L SQLite version Description: The issue concerns a missing authentication vulnerability in the dloader.php file. This vulnerability can be...

LuxSoft LuxCal Web Calendar SQL注入漏洞

LuxSoft LuxCal Web Calendar is a free user-friendly lightweight web-based event calendar from LuxSoft Switzerland. A SQL injection vulnerability exists in LuxSoft LuxCal Web Calendar versions prior to 5.3.3M and prior to 5.3.3L, which stems from information in the database that could be deleted,...

PT-2025-7062 · Unknown · Luxcal Web Calendar

Name of the Vulnerable Software and Affected Versions: LuxCal Web Calendar versions prior to 5.3.3M MySQL version LuxCal Web Calendar versions prior to 5.3.3L SQLite version Description: The issue concerns an SQL injection vulnerability in the retrieve.php file. If exploited, this vulnerability m...

JVN#26024080: Multiple vulnerabilities in The LuxCal Web Calendar

The LuxCal Web Calendar provided by LuxSoft contains multiple vulnerabilities listed below. SQL injection in pdf.php CWE-89 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Base Score 7.3 CVE-2025-25221 SQL injection in retrieve.php CWE-89 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Base Score 7.3...

CVE-2024-13821

The WP Booking Calendar plugin for WordPress is vulnerable to Unauthenticated Post-Confirmation Booking Manipulation in all versions up to, and including, 10.10. This is due to the plugin not properly requiring re-verification after a booking has been made and a change is being attempted. This...

CVE-2024-13821

The WP Booking Calendar plugin for WordPress is vulnerable to Unauthenticated Post-Confirmation Booking Manipulation in all versions up to, and including, 10.10. This is due to the plugin not properly requiring re-verification after a booking has been made and a change is being attempted. This...

CVE-2024-13821 WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation

The WP Booking Calendar plugin for WordPress is vulnerable to Unauthenticated Post-Confirmation Booking Manipulation in all versions up to, and including, 10.10. This is due to the plugin not properly requiring re-verification after a booking has been made and a change is being attempted. This...

CVE-2024-13821 WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation

The WP Booking Calendar plugin for WordPress is vulnerable to Unauthenticated Post-Confirmation Booking Manipulation in all versions up to, and including, 10.10. This is due to the plugin not properly requiring re-verification after a booking has been made and a change is being attempted. This...