CVE-2026-36989 PUBLISHED

Assigner: mitre
Reserved: 06.04.2026 Published: 13.09.2026 Updated: 13.09.2026

A SQL Injection vulnerability exists in LuxSoft LuxCal through 5.3.4L via rssfeed.php and common/retrieve.php.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
CVSS Score: 5.8

Product Status

Vendor LuxSoft
Product LuxCal Web Calendar
Versions Default: unaffected
  • affected from 0 to 5.3.4L (incl.)

References

Problem Types

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE