CVE-2025-25221

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in pdf.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
LuxSoft	The LuxCal Web Calendar	prior to 5.3.3M (MySQL version)
LuxSoft	The LuxCal Web Calendar	prior to 5.3.3L (SQLite version)

References

https://jvn.jp/en/jp/JVN26024080/Third Party Advisory
https://www.luxsoft.eu/?downloadProduct
https://www.luxsoft.eu/lcforum/viewtopic.php?pid=1984#p1984Release Notes

Timeline

Published: Feb 18, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-252229.8The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in retr CVE-2025-252235.3The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a path traversal vulnerability in dloa CVE-2025-252247.5The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a missing authentication vulnerability CVE-2025-252256.5A privilege escalation vulnerability in the Hikashop component versions 1.0.0-5.1.3 for Joomla allows authenticated attackers (administrator CVE-2025-252269.8Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the CVE-2025-252277.5Insufficient state checks lead to a vector that allows to bypass 2FA checks.CVE-2025-252283.8A SQL injection in VirtueMart component 1.0.0 - 4.4.7 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL com CVE-2025-252295.4Omnissa Workspace ONE UEM contains a Server-Side Request Forgery (SSRF) Vulnerability. A malicious actor with user privileges may be able to CVE-2025-25239.4The Honeywell Experion PKS and OneWireless WDM contains an Integer Underflow vulnerability in the component Control Data Access (CD CVE-2025-252307.8Omnissa Horizon Client for Windows contains an LPE Vulnerability. A malicious actor with local access where Horizon Client for Windows is in CVE-2025-252317.5Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to gain access to sensiti CVE-2025-252347.5Omnissa UAG contains a Cross-Origin Resource Sharing (CORS) bypass vulnerability. A malicious actor with network access to UAG may be able t