CVE-2025-65090CWE-200

XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService

Medium · published January 10, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
19.5
In the wild
Unconfirmed
What it is

XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.6, users with the rights to view the Calendar.JSONService page (including guest users) can exploit the data leak vulnerability by accessing database info, with the exception of passwords. This issue has been patched in version 2.4.6.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00281 · 19.5th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-01-10T03:05Z
EPSS history
Timeline
  • 10 JAN 03:05Z
    XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService
    cvelistv5