CVE-2025-52132

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The Mocca Calendar application before 2.15 for XWiki allows XSS via a title to the view event page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Aug 3, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-521336.4The Mocca Calendar application before 2.15 for XWiki allows XSS via a title upon calendar import.CVE-2025-521363.0In EMQX before 5.8.6, administrators can install arbitrary novel plugins via the Dashboard web interface. NOTE: the Supplier's position is tCVE-2025-52149.8A vulnerability was found in Kashipara Responsive Online Learing Platform 1.0. It has been rated as critical. Affected by this issue is someCVE-2025-52159.8A vulnerability classified as critical has been found in D-Link DCS-5020L 1.01_B2. This affects the function websReadEvent of the file /rameCVE-2025-521598.8Hardcoded credentials in default configuration of PPress 0.0.9.CVE-2025-52169.8A vulnerability classified as critical was found in PHPGurukul Student Record System 3.20. This vulnerability affects unknown code of the fiCVE-2025-521619.8Scholl Communications AG Weblication CMS Core v019.004.000.000 was discovered to contain a cross-site scripting (XSS) vulnerability.CVE-2025-521626.5agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain an XML External Entity (XXE) via the RSSReader endpoint. CVE-2025-521636.5A Server-Side Request Forgery (SSRF) in the component TunnelServlet of agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 allows attacCVE-2025-521648.2Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to store credentials in plaintext.CVE-2025-521666.5Incorrect access control in Software GmbH Agorum core open v11.9.2 & v11.10.1 allows authenticated attackers to escalate privileges to AdminCVE-2025-521686.5Incorrect access control in the dynawebservice component of agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 allows unauthenticated
CVE-2025-52132: Medium severity, CVSS 6.4 | Vulnix