PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-36989 LuxSoft CVE debrief

A SQL Injection vulnerability exists in LuxSoft LuxCal through 5.3.4L via rssfeed.php and common/retrieve.php. This CVE was published on 2026-09-13T21:17:01.140Z and was last modified on 2026-09-22T20:00:03.713Z. The NVD entry is currently Deferred. Defenders responsible for LuxSoft LuxCal deployments should assess exposure and prioritize verification of the vulnerability in their environments. The vulnerability is described as CWE-89, indicating a medium severity with a CVSS score of 5.8. The CVE record and NVD detail page provide information about the SQL Injection vulnerability in LuxSoft LuxCal.

Vendor
LuxSoft
Product
LuxCal Web Calendar
CVSS
MEDIUM 5.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-13
Original CVE updated
2026-09-22
Advisory published
2026-09-13
Advisory updated
2026-09-22

Who should care

Defenders responsible for LuxSoft LuxCal deployments should assess exposure and prioritize verification of the vulnerability in their environments.

Why it matters

Defenders should prioritize verifying the vulnerability in LuxSoft LuxCal versions up to 5.3.4L and assessing exposure in their environments due to the potential for SQL injection attacks.

  • Verify vulnerability in LuxSoft LuxCal versions up to 5.3.4L
  • Assess exposure in environments using LuxSoft LuxCal
  • Monitor for potential SQL injection attacks

Technical summary

A SQL Injection vulnerability exists in LuxSoft LuxCal through 5.3.4L via rssfeed.php and common/retrieve.php. The CVSS score is 5.8, indicating a medium severity. The vulnerability is described as CWE-89. Defenders should prioritize verifying the vulnerability in LuxSoft LuxCal versions up to 5.3.4L and assessing exposure in their environments due to the potential for SQL injection attacks. The CVE record and NVD detail page provide information about the SQL Injection vulnerability in LuxSoft LuxCal.

Defensive priority

Defenders should prioritize verifying the vulnerability in LuxSoft LuxCal versions up to 5.3.4L and assessing exposure in their environments.

Recommended defensive actions

  • Verify the vulnerability in LuxSoft LuxCal versions up to 5.3.4L
  • Assess exposure in environments using LuxSoft LuxCal
  • Monitor for potential SQL injection attacks

Evidence notes

The CVE record and NVD detail page provide information about the SQL Injection vulnerability in LuxSoft LuxCal. However, the vendor and product information is not confirmed, and the CVSS score is 5.8, indicating a medium severity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-36989 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-36989

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-36989 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-36989

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.