CVE-2025-65090

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-65090
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-65090.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-65090
Aliases
Published
2026-01-10T03:05:06.531Z
Modified
2026-01-15T05:49:18.674473Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService
Details

XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.6, users with the rights to view the Calendar.JSONService page (including guest users) can exploit the data leak vulnerability by accessing database info, with the exception of passwords. This issue has been patched in version 2.4.6.

Database specific 
{
    "cwe_ids": [
        "CWE-200"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65090.json"
}
References

Affected packages

Git / github.com/xwiki-contrib/macro-fullcalendar

Affected ranges

Type
GIT
Repo
https://github.com/xwiki-contrib/macro-fullcalendar
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
646f70a7de37660ea3e48369798b198339ba73d3

Affected versions

macro-fullcalendar-1.*

macro-fullcalendar-1.1.6
macro-fullcalendar-1.1.7
macro-fullcalendar-1.1.8
macro-fullcalendar-1.1.9

macro-fullcalendar-2.*

macro-fullcalendar-2.0
macro-fullcalendar-2.0.1
macro-fullcalendar-2.0.2
macro-fullcalendar-2.0.3
macro-fullcalendar-2.0.4
macro-fullcalendar-2.1
macro-fullcalendar-2.2.1
macro-fullcalendar-2.2.10
macro-fullcalendar-2.2.11
macro-fullcalendar-2.2.2
macro-fullcalendar-2.2.3
macro-fullcalendar-2.2.5
macro-fullcalendar-2.2.6

macro-fullcalendar-pom-2.*

macro-fullcalendar-pom-2.1.1
macro-fullcalendar-pom-2.1.2
macro-fullcalendar-pom-2.1.3
macro-fullcalendar-pom-2.1.4
macro-fullcalendar-pom-2.1.5
macro-fullcalendar-pom-2.1.6
macro-fullcalendar-pom-2.1.7
macro-fullcalendar-pom-2.1.8
macro-fullcalendar-pom-2.1.9
macro-fullcalendar-pom-2.2
macro-fullcalendar-pom-2.2.12
macro-fullcalendar-pom-2.2.4
macro-fullcalendar-pom-2.2.7
macro-fullcalendar-pom-2.2.8
macro-fullcalendar-pom-2.2.9
macro-fullcalendar-pom-2.3.0
macro-fullcalendar-pom-2.3.1
macro-fullcalendar-pom-2.3.2
macro-fullcalendar-pom-2.4.0
macro-fullcalendar-pom-2.4.1
macro-fullcalendar-pom-2.4.2
macro-fullcalendar-pom-2.4.3
macro-fullcalendar-pom-2.4.4
macro-fullcalendar-pom-2.4.5

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-65090.json"