CVE-2025-52131

Description

The Mocca Calendar application before 2.15 for XWiki allows XSS via the background or text color field.

PUBLISHED Reserved 2025-06-16 | Published 2025-08-03 | Updated 2025-08-07 | Assigner mitre

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

References

github.com/...lendar/security/advisories/GHSA-jvq4-j2qw-q7x2

github.com/xwikisas/application-mocca-calendar

extensions.xwiki.org/xwiki/bin/view/Extension/MoccaCalendar

github.com/xwiki-contrib/application-mocca-calendar

cve.org (CVE-2025-52131)

nvd.nist.gov (CVE-2025-52131)

Download JSON