CVE-2026-67365
CriticalCVSS 9.2Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Joomla extension iCagenda before version 4.0.0-4.0.11 contains an unauthenticated SQL injection vulnerability in the mod_icagenda_calendar module. It is reachable via com_ajax without requiring a session, token, or account.
Risk Assessment
An unauthenticated attacker can manipulate database queries, potentially leading to data disclosure or modification.
Recommendation
Update the iCagenda extension to version 4.0.11 or later, which includes the fix.
Other vulnerabilities in iCagenda
See all- CVE-2026-48939CriticalActively exploited
A vulnerability in the iCagenda extension for Joomla allows arbitrary file upload in the file attachment feature, leading to PHP code upload and execution.
- CVE-2026-75948High
Joomla extension iCagenda 4.0.8 to 4.0.12 has an authenticated stored XSS in the 'Submit an Event' form, where image and file fields are stored without output-side HTML-attribute escaping.
- CVE-2026-71570Medium
The Joomla extension iCagenda before version 2.0.0-4.0.11 contains an ACL bypass vulnerability allowing arbitrary user enumeration. A backend operator with access only to com_icagenda could enumerate Joomla user profiles.
- CVE-2026-67366Medium
The Joomla extension iCagenda before version 2.0.0-4.0.11 contains a CSRF vulnerability in frontend registration actions. Multiple state-changing operations in the frontend are callable without a CSRF token check.
- CVE-2026-71571High
Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.11 - Backend operators with permissions to access iCagenda could inject SQL.
Original NVD description (English source)
Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11 - Unauthenticated SQL injection in mod_icagenda_calendar (iCagenda), reachable via com_ajax with no session, token or account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS