CVE-2026-57831
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The Joomla extension DP Calendar versions 8.18.0 through 10.11.2 is vulnerable to unauthenticated blind SQL injection. An attacker can send crafted queries without authentication.
Risk Assessment
An unauthenticated attacker can read database data, leading to a breach of data confidentiality.
Recommendation
Update the DP Calendar extension to a version later than 10.11.2.
Other vulnerabilities in DP Calendar
See all- CVE-2026-78070Medium
Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2. Saving an article can trigger a blind SQL injection with content plugin, needs update permission for articles.
- CVE-2026-78071High
The DP Calendar extension for Joomla (digital-peak.com) in versions 7.0.0-8.19.5 and 9.0.0-10.12.0 contains an authenticated, privileged stored XSS vulnerability. The location title is rendered in a data attribute without escaping, leading to XSS; create permission in DPCalendar is required.
Original NVD description (English source)
Joomla Extension - digital-peak.com - Unauthenticated blind SQL injection in DP Calendar 8.18.0 - 10.11.2 - The Joomla extension DP Calendar is vulnerable to an unauthenticated SQL injection.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS