GCVE - cpe:2.3:a:nextcloud:calendar:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:nextcloud:calendar:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Nextcloud (`e5ae4298-6932-564f-a40d-08cebea039a5`)
Product	Calendar (`319c0b6e-da99-5681-8a21-629c2ea044cb`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/nextcloud/calendar`	purl2cpe	2026-06-01 10:17:59.585617

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-66550`	vulnerable	2026-06-08 07:41:19.164660	Nextcloud Calendar attachments of local files are offered to downloaded MEDIUM (5.7) Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachment that links to a download link of a file on the same Nextcloud server, the file would be downloaded without the user confirming the action. This vulnerability is fixed in 4.7.17 and 5.2.4. Published: 2025-12-05T16:56:44.680Z Updated: 2025-12-05T18:41:24.347Z Open on db.gcve.eu Reference links https://github.com/nextcloud/security-advisories/security/advisories/GHSA-f29c-ppmv-8mcv https://github.com/nextcloud/calendar/pull/6971 https://github.com/nextcloud/calendar/commit/63a6c398db01391eb9fd5297a0d4c3d6e614f769 https://hackerone.com/reports/3112033	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-66546`	vulnerable	2026-06-08 07:41:19.152464	Nextcloud Calendar app allowed booking appointments without the generated token LOW (3.3) Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1. Published: 2025-12-05T16:49:46.553Z Updated: 2025-12-05T18:32:44.271Z Open on db.gcve.eu Reference links https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7x2j-2674-fj95 https://github.com/nextcloud/calendar/pull/7537 https://github.com/nextcloud/calendar/commit/f41650c3681fc4a4130eb883f5c0899c011326b3 https://hackerone.com/reports/3275810	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-66511`	vulnerable	2026-06-08 07:41:19.095343	Nextcloud Calendar app used predictable proposal participant tokens MEDIUM (4.8) Nextcloud Calendar is a calendar app for Nextcloud. Prior to 6.0.3, the Calendar app generates participant tokens for meeting proposals using a hash function, allowing an attacker to compute valid participant tokens, which allowed them to request details and submit dates in meeting proposals. The tokens are not purely random generated. This vulnerability is fixed in 6.0.3. Published: 2025-12-05T16:42:30.236Z Updated: 2025-12-05T16:53:52.674Z Open on db.gcve.eu Reference links https://github.com/nextcloud/security-advisories/security/advisories/GHSA-whm3-vv55-gf27 https://github.com/nextcloud/calendar/pull/7659 https://github.com/nextcloud/calendar/commit/8de14ae87f321f5f09280d9895a27d54d24f33fb https://hackerone.com/reports/3385434	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-37316`	vulnerable	2026-06-08 06:39:47.134144	Nextcloud Calendar's event create can create attachments that link to other websites MEDIUM (4.6) Nextcloud Calendar is a calendar app for Nextcloud. Authenticated users could create an event with manipulated attachment data leading to a bad redirect for participants when clicked. It is recommended that the Nextcloud Calendar App is upgraded to 4.6.8 or 4.7.2. Published: 2024-06-14T15:23:12.705Z Updated: 2024-08-02T03:50:56.106Z Open on db.gcve.eu Reference links https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2r7q-vfmv-79qf https://github.com/nextcloud/calendar/pull/5966 https://hackerone.com/reports/2457588	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-48308`	vulnerable	2026-06-08 06:14:26.849780	Calendar app returns full stacktrace when an error happens while editing appointment LOW (3.5) Nextcloud/Cloud is a calendar app for Nextcloud. An attacker can gain access to stacktrace and internal paths of the server when generating an exception while editing a calendar appointment. It is recommended that the Nextcloud Calendar app is upgraded to 4.5.3 Published: 2023-12-21T23:12:45.538Z Updated: 2024-11-27T15:46:01.287Z Open on db.gcve.eu Reference links https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fv3c-qvjr-5rv8 https://github.com/nextcloud/calendar/pull/5553	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-45150`	vulnerable	2026-06-08 06:12:42.063246	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-33183`	vulnerable	2026-06-08 06:06:21.936899	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-24838`	vulnerable	2026-06-08 05:41:44.733318	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-3763`	vulnerable	2026-06-08 05:11:41.253481	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.