CVE Catalog
CVE-2026-67365
CriticalCVSS 9.2Summary
The Joomla extension iCagenda before version 4.0.0-4.0.11 contains an unauthenticated SQL injection vulnerability in the mod_icagenda_calendar module. It is reachable via com_ajax without requiring a session, token, or account.
Risk Assessment
An unauthenticated attacker can manipulate database queries, potentially leading to data disclosure or modification.
Recommendation
Update the iCagenda extension to version 4.0.11 or later, which includes the fix.
Original NVD description (English source)
Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11 - Unauthenticated SQL injection in mod_icagenda_calendar (iCagenda), reachable via com_ajax with no session, token or account.