CVE-2025-25222

9.8 criticalEPSS 0.5%

Critical (9.8) in luxsoft luxcal web calendar. EPSS 0.5% chance of exploitation in the next 30 days.

The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in retrieve.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2025-02-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

luxsoft:luxcal_web_calendar

References

https://jvn.jp/en/jp/JVN26024080/
https://www.luxsoft.eu/?download
https://www.luxsoft.eu/lcforum/viewtopic.php?pid=1984#p1984

Check your stack JSON