CVE-2025-25224

The CVE-2025-25224 entry concerns LuxCal Web Calendar prior to 5.3.3M (MySQL) and 5.3.3L (SQLite), where dloader.php has a missing authentication vulnerability that can allow arbitrary server file disclosure. Affected product is LuxCal Web Calendar; root cause is missing access control in dloader...

CVE-2025-25223

CVE-2025-25223 : Path traversal in LuxCal Web Calendar’s dloader.php allows disclosure of arbitrary server files. Affected versions: LuxCal Web Calendar prior to 5.3.3M (MySQL) and prior to 5.3.3L (SQLite). Remediation: update to 5.3.3M/L or later.

CVE-2025-25222

CVE-2025-25222 affects LuxCal Web Calendar. Multiple connected sources confirm an SQL injection vulnerability in retrieve.php present in LuxCal versions prior to 5.3.3M (MySQL) and prior to 5.3.3L (SQLite). Root cause: unsafely constructed SQL in retrieve.php allows unauthorized access to databas...

CVE-2025-25221

The CVE-2025-25221 issue affects LuxCal Web Calendar. A SQL injection vulnerability in pdf.php impacts LuxCal versions prior to 5.3.3M (MySQL) and prior to 5.3.3L (SQLite). Exploitation could allow deletion, alteration, or retrieval of database information, per multiple connected sources. The roo...

CVE-2023-39939

CVE-2023-39939 describes an SQL injection in LuxCal Web Calendar prior to 5.2.3M (MySQL) and prior to 5.2.3L (SQLite), allowing remote, unauthenticated attackers to execute arbitrary queries and access/alter data. Connected sources confirm affected LuxCal Web Calendar components and indicate miti...

CVE-2023-39543

CVE-2023-39543 describes a cross-site scripting (XSS) vulnerability in LuxCal Web Calendar. The issue affects LuxCal Web Calendar versions prior to 5.2.3M (MySQL) and prior to 5.2.3L (SQLite). The underlying behavior allows a remote unauthenticated attacker to cause arbitrary script execution in ...

CVE-2023-46700

LuxCal Web Calendar is affected by a SQL injection vulnerability tracked as CVE-2023-46700. The issue permits an unauthenticated remote attacker to craft requests that execute arbitrary SQL commands, enabling access to or modification of database information. Affected products are LuxCal Web Cale...

CVE-2023-47175

LuxCal Web Calendar (LuxSoft) is affected by a cross-site scripting (XSS) vulnerability (CVE-2023-47175) in versions prior to 5.2.4M (MySQL) and prior to 5.2.4L (SQLite). An unauthenticated remote attacker can execute arbitrary script in the web browser of a user accessing the product. Remediatio...