Vulnerability-Lookup - Search a vulnerability

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000117.html",
  "dc:date": "2023-11-20T17:15+09:00",
  "dcterms:issued": "2023-11-20T17:15+09:00",
  "dcterms:modified": "2023-11-20T17:15+09:00",
  "description": "LuxCal Web Calendar provided by LuxSoft contains multiple vulnerabilities listed below.\r\n\r\n\u003cul\u003e\u003cli\u003eSQL injection (CWE-89) - CVE-2023-46700\u003c/li\u003e\u003cli\u003eCross-site scripting (CWE-79) - CVE-2023-47175\u003c/li\u003e\u003c/ul\u003e\r\nYuji Tounai of Mitsui Bussan Secure Directions, Inc. reported these vulnerabilities to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000117.html",
  "sec:cpe": {
    "#text": "cpe:/a:luxsoft:luxcal_web_calendar",
    "@product": "The LuxCal Web Calendar",
    "@vendor": "LuxSoft",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "7.5",
      "@severity": "High",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "7.3",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2023-000117",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN15005948/index.html",
      "@id": "JVN#15005948",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-46700",
      "@id": "CVE-2023-46700",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-47175",
      "@id": "CVE-2023-47175",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-46700",
      "@id": "CVE-2023-46700",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-47175",
      "@id": "CVE-2023-47175",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-89",
      "@title": "SQL Injection(CWE-89)"
    }
  ],
  "title": "Multiple vulnerabilities in LuxCal Web Calendar"
}

jvndb-2023-000083

Vulnerability from jvndb

Published

2023-08-21 13:29

Modified

2024-03-26 17:09

Severity ?

7.3 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Summary

Multiple vulnerabilities in LuxCal Web Calendar

Details

LuxCal Web Calendar provided by LuxSoft contains multiple vulnerabilities listed below. * Cross-site scripting (CWE-79) - CVE-2023-39543 * SQL injection (CWE-89) - CVE-2023-39939 Yuji Tounai of Mitsui Bussan Secure Directions, Inc. reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

►

Type

URL

	JVN	http://jvn.jp/en/jp/JVN04876736/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-39543
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-39939
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-39543
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-39939
	Cross-site Scripting(CWE-79)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	SQL Injection(CWE-89)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

►

Vendor

Product

LuxSoft

The LuxCal Web Calendar

Show details on JVN DB website

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000083.html",
  "dc:date": "2024-03-26T17:09+09:00",
  "dcterms:issued": "2023-08-21T13:29+09:00",
  "dcterms:modified": "2024-03-26T17:09+09:00",
  "description": "LuxCal Web Calendar provided by LuxSoft contains multiple vulnerabilities listed below.\r\n\r\n  * Cross-site scripting (CWE-79) - CVE-2023-39543\r\n  * SQL injection (CWE-89) - CVE-2023-39939\r\n\r\nYuji Tounai of Mitsui Bussan Secure Directions, Inc. reported these vulnerabilities to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000083.html",
  "sec:cpe": {
    "#text": "cpe:/a:luxsoft:luxcal_web_calendar",
    "@product": "The LuxCal Web Calendar",
    "@vendor": "LuxSoft",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "7.5",
      "@severity": "High",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "7.3",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2023-000083",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN04876736/index.html",
      "@id": "JVN#04876736",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-39543",
      "@id": "CVE-2023-39543",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-39939",
      "@id": "CVE-2023-39939",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-39543",
      "@id": "CVE-2023-39543",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-39939",
      "@id": "CVE-2023-39939",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-89",
      "@title": "SQL Injection(CWE-89)"
    }
  ],
  "title": "Multiple vulnerabilities in LuxCal Web Calendar"
}

jvndb-2025-000012

Vulnerability from jvndb

Published

2025-02-17 13:43

Modified

2025-02-17 13:43

Severity ?

7.3 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Summary

Multiple vulnerabilities in The LuxCal Web Calendar

Details

The LuxCal Web Calendar provided by LuxSoft contains multiple vulnerabilities listed below. <ul><li>SQL injection in pdf.php (CWE-89) - CVE-2025-25221</li> <li>SQL injection in retrieve.php (CWE-89) - CVE-2025-25222</li> <li>Path traversal in dloader.php (CWE-22) - CVE-2025-25223</li> <li>Missing authentication in dloader.php (CWE-306) - CVE-2025-25224</li></ul> CVE-2025-25221, CVE-2025-25222 Rikuto Tauchi reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2025-25223, CVE-2025-25224 Yuji Tounai of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

►

Type

URL

	JVN	https://jvn.jp/en/jp/JVN26024080/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-25221
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-25222
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-25223
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-25224
	Path Traversal(CWE-22)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	SQL Injection(CWE-89)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	No Mapping(CWE-Other)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

►

Vendor

Product

LuxSoft

The LuxCal Web Calendar

Show details on JVN DB website

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000012.html",
  "dc:date": "2025-02-17T13:43+09:00",
  "dcterms:issued": "2025-02-17T13:43+09:00",
  "dcterms:modified": "2025-02-17T13:43+09:00",
  "description": "The LuxCal Web Calendar provided by LuxSoft contains multiple vulnerabilities listed below.\r\n\u003cul\u003e\u003cli\u003eSQL injection in pdf.php (CWE-89) - CVE-2025-25221\u003c/li\u003e\r\n\u003cli\u003eSQL injection in retrieve.php (CWE-89) - CVE-2025-25222\u003c/li\u003e\r\n\u003cli\u003ePath traversal in dloader.php (CWE-22) - CVE-2025-25223\u003c/li\u003e\r\n\u003cli\u003eMissing authentication in dloader.php (CWE-306) - CVE-2025-25224\u003c/li\u003e\u003c/ul\u003e\r\n\r\nCVE-2025-25221, CVE-2025-25222\r\nRikuto Tauchi reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\n\r\nCVE-2025-25223, CVE-2025-25224\r\nYuji Tounai of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000012.html",
  "sec:cpe": {
    "#text": "cpe:/a:luxsoft:luxcal_web_calendar",
    "@product": "The LuxCal Web Calendar",
    "@vendor": "LuxSoft",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "7.3",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2025-000012",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN26024080/index.html",
      "@id": "JVN#26024080",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-25221",
      "@id": "CVE-2025-25221",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-25222",
      "@id": "CVE-2025-25222",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-25223",
      "@id": "CVE-2025-25223",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-25224",
      "@id": "CVE-2025-25224",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-22",
      "@title": "Path Traversal(CWE-22)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-89",
      "@title": "SQL Injection(CWE-89)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Multiple vulnerabilities in The LuxCal Web Calendar"
}

CVE-2025-25224 (GCVE-0-2025-25224)

Vulnerability from cvelistv5

Published

2025-02-18 00:12

Modified

2025-02-18 19:29

Severity ?

5.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-306 - Missing authentication for critical function

Summary

The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a missing authentication vulnerability in dloader.php. If this vulnerability is exploited, arbitrary files on a server may be obtained.

References

►

URL

Tags

	https://www.luxsoft.eu/?download
	https://www.luxsoft.eu/lcforum/viewtopic.php?pid=1984#p1984
	https://jvn.jp/en/jp/JVN26024080/

Impacted products

Vendor

Product

Version

►

Version: prior to 5.3.3M (MySQL version)

Version: prior to 5.3.3L (SQLite version)

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-25224",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-18T17:12:59.444452Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-18T19:29:03.746Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "The LuxCal Web Calendar",
          "vendor": "LuxSoft",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 5.3.3M (MySQL version)"
            }
          ]
        },
        {
          "product": "The LuxCal Web Calendar",
          "vendor": "LuxSoft",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 5.3.3L (SQLite version)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a missing authentication vulnerability in dloader.php. If this vulnerability is exploited, arbitrary files on a server may be obtained."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "Missing authentication for critical function",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-18T00:12:21.912Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.luxsoft.eu/?download"
        },
        {
          "url": "https://www.luxsoft.eu/lcforum/viewtopic.php?pid=1984#p1984"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN26024080/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-25224",
    "datePublished": "2025-02-18T00:12:21.912Z",
    "dateReserved": "2025-02-04T05:38:52.829Z",
    "dateUpdated": "2025-02-18T19:29:03.746Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-25221 (GCVE-0-2025-25221)

Vulnerability from cvelistv5

Published

2025-02-18 00:10

Modified

2025-02-18 15:24

Severity ?

7.3 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL Injection')

Summary

The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in pdf.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved.

References

►

URL

Tags

	https://www.luxsoft.eu/?download
	https://www.luxsoft.eu/lcforum/viewtopic.php?pid=1984#p1984
	https://jvn.jp/en/jp/JVN26024080/

Impacted products

Vendor

Product

Version

►

Version: prior to 5.3.3M (MySQL version)

Version: prior to 5.3.3L (SQLite version)

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-25221",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-18T15:24:31.523522Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-18T15:24:46.624Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "The LuxCal Web Calendar",
          "vendor": "LuxSoft",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 5.3.3M (MySQL version)"
            }
          ]
        },
        {
          "product": "The LuxCal Web Calendar",
          "vendor": "LuxSoft",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 5.3.3L (SQLite version)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in pdf.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper neutralization of special elements used in an SQL command (\u0027SQL Injection\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-18T00:10:25.747Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.luxsoft.eu/?download"
        },
        {
          "url": "https://www.luxsoft.eu/lcforum/viewtopic.php?pid=1984#p1984"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN26024080/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-25221",
    "datePublished": "2025-02-18T00:10:25.747Z",
    "dateReserved": "2025-02-04T05:38:52.829Z",
    "dateUpdated": "2025-02-18T15:24:46.624Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-25222 (GCVE-0-2025-25222)

Vulnerability from cvelistv5

Published

2025-02-18 00:11

Modified

2025-02-18 19:29

Severity ?

7.3 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL Injection')

Summary

The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in retrieve.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved.

References

►

URL

Tags

	https://www.luxsoft.eu/?download
	https://www.luxsoft.eu/lcforum/viewtopic.php?pid=1984#p1984
	https://jvn.jp/en/jp/JVN26024080/

Impacted products

Vendor

Product

Version

►

Version: prior to 5.3.3M (MySQL version)

Version: prior to 5.3.3L (SQLite version)

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-25222",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-18T17:13:37.186935Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-18T19:29:28.127Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "The LuxCal Web Calendar",
          "vendor": "LuxSoft",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 5.3.3M (MySQL version)"
            }
          ]
        },
        {
          "product": "The LuxCal Web Calendar",
          "vendor": "LuxSoft",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 5.3.3L (SQLite version)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in retrieve.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper neutralization of special elements used in an SQL command (\u0027SQL Injection\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-18T00:11:03.172Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.luxsoft.eu/?download"
        },
        {
          "url": "https://www.luxsoft.eu/lcforum/viewtopic.php?pid=1984#p1984"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN26024080/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-25222",
    "datePublished": "2025-02-18T00:11:03.172Z",
    "dateReserved": "2025-02-04T05:38:52.829Z",
    "dateUpdated": "2025-02-18T19:29:28.127Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-25223 (GCVE-0-2025-25223)

Vulnerability from cvelistv5

Published

2025-02-18 00:11

Modified

2025-02-18 19:29

Severity ?

5.8 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

CWE

CWE-22 - Improper limitation of a pathname to a restricted directory ('Path Traversal')

Summary

The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a path traversal vulnerability in dloader.php. If this vulnerability is exploited, arbitrary files on a server may be obtained.

References

►

URL

Tags

	https://www.luxsoft.eu/?download
	https://www.luxsoft.eu/lcforum/viewtopic.php?pid=1984#p1984
	https://jvn.jp/en/jp/JVN26024080/

Impacted products

Vendor

Product

Version

►

Version: prior to 5.3.3M (MySQL version)

Version: prior to 5.3.3L (SQLite version)

Show details on NVD website