CVE-2025-25224

Summary

CVE-2025-25224 is a newly disclosed vulnerability affecting the LuxCal Web Calendar application. Versions prior to 5.3.3M (MySQL) and 5.3.3L (SQLite) are reportedly vulnerable. The issue lies in the dloader.php file, which lacks adequate authentication. Successful exploitation of this weakness allows attackers to gain unauthorized access to arbitrary files on the affected server. This vulnerability poses a significant risk and necessitates immediate patching or mitigation measures.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.