What is CVE-2025-65091?

CVE-2025-65091 is a critical-severity vulnerability in Xwiki Full Calendar Macro, classified under SQL Injection. CVSS score: 10.0/10. Published 2026-01-10.

How severe is CVE-2025-65091?

Critical severity. CVSS v3 base score is 10.0 out of 10.

SQL Injection in Xwiki Full Calendar Macro

CVE-2025-65091

XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.5, users with the right to view the Calendar.JSONService page (including guest users) can exploit a SQL injection vulnerability by accessing database info or starting a DoS attack. This issue has been patched in version 2.4.5.

Vulnerability class: SQL Injection

Published 2026-01-10 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.003 (22.7th percentile), scored 2026-10-02.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 23rd percentile — 22.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: +0.000

Affected products

Xwiki Full Calendar Macro
Xwiki-Contrib Macro-Fullcalendar — versions < 2.4.5

Weakness classification (CWE)

CWE-89 — SQL Injection

References

github.com/xwiki-contrib/macro-fullcalendar/security/advisories/GHSA-2g22-wg49-… (Third Party Advisory)
github.com/xwiki-contrib/macro-fullcalendar/commit/5fdcf06a05015786492fda69b4d9… (Patch)

Frequently asked questions

What is CVE-2025-65091?: CVE-2025-65091 is a critical-severity vulnerability in Xwiki Full Calendar Macro, classified under SQL Injection. CVSS score: 10.0/10. Published 2026-01-10.
How severe is CVE-2025-65091?: Critical severity. CVSS v3 base score is 10.0 out of 10.