Login Request a demo
LW
Product
LuxCal Web Calendar
by LuxSoft · last CVE Sep 13, 2026
9
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities9In the news0Timeline
Severity mix
Critical 4High 1Medium 4Low 0
Severity
All severities9Critical4High1Medium4Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add LuxCal Web Calendar to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-25222
9.8
0%
Feb 18
The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in retrieve.php
Affected: before 5.3.3l; before 5.3.3m
CVE-2025-25221
9.8
0%
Feb 18
The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in pdf.php
Affected: before 5.3.3l; before 5.3.3m
CVE-2023-46700
9.8
1%
Nov 20
SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated…
Affected: prior to 5.2.4M (MySQL version); prior to 5.2.4L (SQLite version)
CVE-2023-39939
9.1
1%
Aug 21
SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite version) allows a remote unauthenticated…
Affected: prior to 5.2.3M (MySQL version); prior to 5.2.3L (SQLite version)
CVE-2025-25224
7.5
1%
Feb 18
The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a missing authentication vulnerability in dloader.php
Affected: before 5.3.3l; before 5.3.3m
CVE-2023-47175
6.1
1%
Nov 20
Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated…
Affected: prior to 5.2.4M (MySQL version); prior to 5.2.4L (SQLite version)
CVE-2023-39543
6.1
1%
Aug 21
Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite version) allows a remote unauthenticated…
Affected: prior to 5.2.3M (MySQL version); prior to 5.2.3L (SQLite version)
CVE-2026-36989
5.8
0%
Sep 13
A SQL Injection vulnerability exists in LuxSoft LuxCal through 5.3.4L via rssfeed.php and common/retrieve.php
Affected: through 5.3.4L
CVE-2025-25223
5.3
1%
Feb 18
The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a path traversal vulnerability in dloader.php
Affected: before 5.3.3l; before 5.3.3m
Showing 9