LuxCal Web Calendar vulnerabilities

5 known vulnerabilities in LuxCal Web Calendar from LuxSoft. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  The LuxCal Web Calendar: Missing Authentication for Critical Functionality

  CVE-2025-25224Feb 18, 2025LuxSoft

  The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a missing authentication vulnerability in dloader.php. If this vulnerability is exploited, arbitrary files on a server may be obtained.

• 9.8 Critical severity

  The LuxCal Web Calendar: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-25222Feb 18, 2025LuxSoft

  The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in retrieve.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved.

• 9.8 Critical severity

  The LuxCal Web Calendar: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-25221Feb 18, 2025LuxSoft

  The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in pdf.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved.

• 9.8 Critical severity

  LuxCal Web Calendar: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-46700Nov 20, 2023LuxSoftEPSS 1.03%

  SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary SQL command by sending a crafted request, and obtain or

• 9.1 Critical severity

  LuxCal Web Calendar: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-39939Aug 21, 2023LuxSoft

  SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite version) allows a remote unauthenticated attacker to execute arbitrary queries against the database and obtain or alter the infor