Skip to content
OpenAdvisories
High WID-SEC-2026-0060 2 CVEs

xwiki (Full Calendar Macro): Mehrere Schwachstellen

Published Jan 11, 2026 · Updated Jan 11, 2026 · de-DE

Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in xwiki ausnutzen, um Informationen offenzulegen, eine SQL-Injection durchzuführen oder einen Denial-of-Service-Zustand zu verursachen.

Product

XWiki ist eine Open-Source-Wiki-Software-Plattform, für die Erstellung und Verwaltung von Wikis und Knowledge-Management-Systemen

Vulnerabilities 2

  • Critical 10.0
    CVE-2025-65091

    XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService

    XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.5, users with the right to view the Calendar.JSONService page (including guest users) can exploit a SQL injection vulnerability by accessing database info or starti…

    xwiki-contrib macro-fullcalendar org.xwiki.contrib:macro-fullcalendar-pom Maven
  • Medium 5.3
    CVE-2025-65090

    XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService

    XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.6, users with the rights to view the Calendar.JSONService page (including guest users) can exploit the data leak vulnerability by accessing database info, with the …

    xwiki-contrib macro-fullcalendar org.xwiki.contrib:macro-fullcalendar-pom Maven

Revision history

  1. #1

    Initiale Fassung

References