Headline
GHSA-2g22-wg49-fgv5: XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService
Impact
Anyone who has view rights on the Calendar.JSONService page, including guest users can exploit this vulnerability by accessing database info or starting a DoS attack.
Workarounds
Remove the Calendar.JSONService page. This will however break some functionalities.
References
Jira issue:
- FULLCAL-80: SQL injection through Calendar.JSONService
- FULLCAL-81: SQL injection through Calendar.JSONService still exists
For more information
If there are any questions or comments about this advisory:
- Open an issue in Jira XWiki.org
- Email Security Mailing List
Skip to content
Navigation Menu
AI CODE CREATION
GitHub CopilotWrite better code with AI
GitHub SparkBuild and deploy intelligent apps
GitHub ModelsManage and compare prompts
MCP RegistryNewIntegrate external tools
View all features
- Pricing
Provide feedback
Saved searches****Use saved searches to filter your results more quickly
Sign up
Appearance settings
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2025-65091
XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService
Package
maven org.xwiki.contrib:macro-fullcalendar-pom (Maven)
Affected versions
<= 2.4.3
Description
Published to the GitHub Advisory Database
Jan 9, 2026
EPSS score