CVE-2026-71571
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.11 - Backend operators with permissions to access iCagenda could inject SQL.
Risk Assessment
An authenticated operator could inject SQL queries, potentially leading to unauthorized data access or modification.
Recommendation
Update the iCagenda extension to version 2.0.0-4.0.11 or later and restrict operator privileges.
Other vulnerabilities in iCagenda
See all- CVE-2026-67365Critical
The Joomla extension iCagenda before version 4.0.0-4.0.11 contains an unauthenticated SQL injection vulnerability in the mod_icagenda_calendar module. It is reachable via com_ajax without requiring a session, token, or account.
- CVE-2026-48939CriticalActively exploited
A vulnerability in the iCagenda extension for Joomla allows arbitrary file upload in the file attachment feature, leading to PHP code upload and execution.
- CVE-2026-75948High
Joomla extension iCagenda 4.0.8 to 4.0.12 has an authenticated stored XSS in the 'Submit an Event' form, where image and file fields are stored without output-side HTML-attribute escaping.
- CVE-2026-71570Medium
The Joomla extension iCagenda before version 2.0.0-4.0.11 contains an ACL bypass vulnerability allowing arbitrary user enumeration. A backend operator with access only to com_icagenda could enumerate Joomla user profiles.
- CVE-2026-67366Medium
The Joomla extension iCagenda before version 2.0.0-4.0.11 contains a CSRF vulnerability in frontend registration actions. Multiple state-changing operations in the frontend are callable without a CSRF token check.
Original NVD description (English source)
Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.11 - Backend operators with permissions to access iCagenda could inject SQL.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS