Medium severity · published Sep 13, 2026
CVE-2026-36989
A SQL Injection vulnerability exists in LuxSoft LuxCal through 5.3.4L via rssfeed.php and common/retrieve.php
5.8
CVSS
0.3%
EPSS
No
On KEV
Description
A SQL Injection vulnerability exists in LuxSoft LuxCal through 5.3.4L via rssfeed.php and common/retrieve.php.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LW
LuxCal Web Calendar · LuxSoft
through 5.3.4L · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-36989
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-36989
gist.github.com
https://gist.github.com/mathysEthical/8c3c426e89c6e48911acf8513fd1f075
mathys.reboux.pro
https://mathys.reboux.pro/CVE/2026/36989/
More from LuxCal Web Calendar
9.8
CVE-2025-25222
The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in retrieve.php
9.8
CVE-2025-25221
The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in pdf.php
9.8
CVE-2023-46700
SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated…
9.1
CVE-2023-39939
SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite version) allows a remote unauthenticated…
7.5
CVE-2025-25224
The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a missing authentication vulnerability in dloader.php