CVE-2025-65091: 
Java vulnerability analysis and mitigation

CVE-2025-65091 is a critical SQL injection vulnerability in the XWiki Full Calendar Macro (org.xwiki.contrib:macro-fullcalendar-pom) that allows unauthenticated attackers, including guest users, to access sensitive database information or launch denial-of-service attacks via the Calendar.JSONService page. It affects all versions up to and including 2.4.3, and was patched in version 2.4.5. The advisory was published on January 9, 2026, with NVD publication on January 10, 2026. It carries a CVSS v3.1 base score of 10.0 (Critical) (Github Advisory, XWiki Advisory).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where the Calendar.JSONService page in the XWiki Full Calendar Macro directly incorporated user-supplied request parameters — specifically $request.sql, $request.fromsql, and $request.wheresql — into HQL (Hibernate Query Language) queries without sanitization or parameterization. The fix, visible in commit 5fdcf06, replaced the direct string interpolation with a parameterized query using .bindValue("classname", ...) and dropped programming rights before query execution via $xcontext.dropPermissions(). Because the Calendar.JSONService page is accessible to guest users by default, no authentication is required to trigger the injection (XWiki Advisory, Patch Commit).

Successful exploitation allows any unauthenticated attacker with network access to extract sensitive data from the underlying database, potentially exposing all wiki content, user credentials, and configuration data. Attackers can also craft queries to cause a denial-of-service condition, disrupting availability of the XWiki instance. The CVSS scope is marked as "Changed," indicating that the impact extends beyond the vulnerable component itself, with full compromise of confidentiality, integrity, and availability (Github Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The vulnerability requires no authentication, no user interaction, and is remotely exploitable over the network, making it trivially accessible to any attacker who can reach the XWiki instance. The EPSS score is approximately 0.031% (per Feedly data) to 0.153% (per GitHub Advisory Database), placing it in the 36th percentile for exploitation likelihood. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Reconnaissance: Identify publicly accessible XWiki instances running the Full Calendar Macro (versions ≤ 2.4.3) using search engines like Shodan or Censys, or by browsing to known XWiki paths.
2. Locate the vulnerable endpoint: Navigate to the Calendar.JSONService page on the target XWiki instance (e.g., https://target-wiki/xwiki/bin/get/Calendar/JSONService).
3. Craft a malicious SQL/HQL payload: Inject SQL/HQL syntax into the sql, fromsql, or wheresql request parameters. For example, append a crafted wheresql parameter that includes a UNION-based or boolean-based injection to extract data from the database.
4. Send the request: Submit the crafted HTTP GET or POST request to the Calendar.JSONService endpoint without any authentication credentials.
5. Extract data or trigger DoS: Observe the JSON response for leaked database content, or send resource-intensive queries to exhaust database resources and cause a denial-of-service condition (XWiki Advisory, Patch Commit).

• Network: Unusual or repeated HTTP requests to /xwiki/bin/get/Calendar/JSONService with unexpected or encoded query parameters (sql, fromsql, wheresql) from external or unknown IP addresses.
• Logs: XWiki access logs showing requests to Calendar/JSONService with SQL-like syntax in query parameters (e.g., UNION, SELECT, --, OR 1=1); database error messages or stack traces in XWiki server logs related to HQL query execution.
• Application Behavior: Unexpectedly slow database responses or elevated database CPU/memory usage consistent with resource-exhausting queries; JSON responses containing unexpected database schema or data not related to calendar objects.

Upgrade the XWiki Full Calendar Macro to version 2.4.5 or later, which addresses the SQL injection by using parameterized HQL queries and dropping elevated permissions before query execution. As an immediate workaround if upgrading is not possible, remove the Calendar.JSONService page from the XWiki instance — note this will break calendar data-loading functionality. Additionally, restrict view permissions on the Calendar.JSONService page to authenticated users only, and consider deploying a web application firewall (WAF) to filter requests containing SQL injection patterns to this endpoint (Github Advisory, XWiki Advisory).

The vulnerability was reported by ChiuchiuSorin and published via the GitHub Advisory Database on January 9, 2026. Coverage appeared on security aggregators and community platforms including TheHackerWire, Bluesky, and Infosec.exchange shortly after disclosure. No major vendor statements or notable researcher commentary beyond the advisory itself have been identified (Github Advisory).