CVE-2025-65091

CVE-2025-65091 is a critical SQL injection vulnerability affecting the XWiki Full Calendar Macro prior to version 2.4.5. This flaw allows any user, including unauthenticated guests, with access to the Calendar.JSONService page to extract sensitive database information or launch denial-of-service attacks. With a CVSS score of 10.0 (CRITICAL), it presents a severe risk due to its network-based attack vector, low complexity, and complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation, public exploit code, or KEV listing, the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation.