CVE-2025-65091: SQL Injection Vulnerability in org.xwiki.contrib:macro-fullcalendar-pom
Summary
CVE-2025-65091: XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService. Affects org.xwiki.contrib:macro-fullcalendar-pom versions < 2.4.5. Fixed in 2.4.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.xwiki.contrib:macro-fullcalendar-pom package is a component of XWiki that provides a full calendar macro for displaying events. It allows users to integrate calendar functionalities into their XWiki pages. However, this package is vulnerable to SQL injection through the Calendar.JSONService, which can be exploited by users with view rights, including guest users.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the Calendar.JSONService page, allowing attackers to execute arbitrary SQL queries against the database. This can lead to unauthorized access to sensitive database information or even denial-of-service (DoS) attacks. The vulnerability is classified under CWE-89, indicating its nature as an SQL injection flaw.
How To Fix
Minimum fixed version
2.4.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can remove the Calendar.JSONService page. However, please note that this will break some functionalities associated with the calendar features in XWiki.
Conclusion
The SQL injection vulnerability in the org.xwiki.contrib:macro-fullcalendar-pom package poses significant risks to users with view rights. It is crucial to update to the patched version 2.4.5 or later to mitigate these risks. Alternatively, removing the Calendar.JSONService page can serve as a temporary workaround, though it may disrupt functionality.
See every vulnerability recorded for org.xwiki.contrib:macro-fullcalendar-pom →
FAQ
SQL injection is a code injection technique that exploits a vulnerability in an application's software by allowing an attacker to interfere with the queries that an application makes to its database.
Any user with view rights on the Calendar.JSONService page, including guest users, can exploit this vulnerability.
The vulnerability can lead to unauthorized access to sensitive database information and may allow attackers to perform denial-of-service (DoS) attacks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against this vulnerability using the Vulert playground at Vulert Scanner without any signup.
The CVSS score of this vulnerability is 10.0, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.contrib:macro-fullcalendar-pom.
