CVE-2025-25221

Summary

CVE-2025-25221 is a newly disclosed vulnerability affecting the LuxCal Web Calendar. Before version 5.3.3M for MySQL databases and 5.3.3L for SQLite databases, this software contains an SQL injection vulnerability in the pdf.php file. Successful exploitation of this weakness allows an attacker to delete, alter, or retrieve sensitive information stored in the database. Users are strongly advised to update their LuxCal installations immediately to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.