Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

8 records

Vendor: LuxSoft Component: Luxcal Web Calendar Clear all filters
TI-2025-18892 CVE-2025-25224 · GHSA-f52p-4vq3-mmgf

Missing authentication in LuxSoft The LuxCal Web Calendar

Priority MEDIUM 40

The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a missing authentication vulnerability in dloader.php.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00577 Published 2025-02-18 No fix listed CWE-306
TI-2025-18891 CVE-2025-25223 · GHSA-w5f3-mp44-xpmq

Path traversal in LuxSoft The LuxCal Web Calendar

Priority LOW 31

The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a path traversal vulnerability in dloader.php.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00635 Published 2025-02-18 No fix listed CWE-22
TI-2025-18890 CVE-2025-25222 · GHSA-2jpm-37j9-vp2m

SQL injection in LuxSoft The LuxCal Web Calendar

Priority MEDIUM 49

The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in retrieve.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00476 Published 2025-02-18 No fix listed CWE-89
TI-2025-18889 CVE-2025-25221 · GHSA-x552-j8v3-6gpf

SQL injection in LuxSoft The LuxCal Web Calendar

Priority MEDIUM 49

The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in pdf.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00476 Published 2025-02-18 No fix listed CWE-89
TI-2023-25499 CVE-2023-47175 · GHSA-xw85-vh2x-vg5q

Cross-site scripting in LuxSoft LuxCal Web Calendar

Priority LOW 28

Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary script o…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00683 Published 2023-11-20 No fix listed CWE-79
TI-2023-25192 CVE-2023-46700 · GHSA-39xr-x89f-x723

SQL injection in LuxSoft LuxCal Web Calendar

Priority MEDIUM 51

SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary SQL command by…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0103 Published 2023-11-20 No fix listed CWE-89
TI-2023-20834 CVE-2023-39939 · GHSA-7r2g-65v5-gwjj

SQL injection in LuxSoft LuxCal Web Calendar

Priority MEDIUM 49

SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite version) allows a remote unauthenticated attacker to execute arbitrary queries against th…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00964 Published 2023-08-21 No fix listed CWE-89
TI-2023-20675 CVE-2023-39543 · GHSA-qqrg-2fcm-mwrq

Cross-site scripting in LuxSoft LuxCal Web Calendar

Priority LOW 28

Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary script o…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00672 Published 2023-08-21 No fix listed CWE-79