CVE-2026-78070
MediumCVSS 6.9Summary
Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2. Saving an article can trigger a blind SQL injection with content plugin, needs update permission for articles.
Risk Assessment
An attacker with article update permissions can execute unauthorized database queries, potentially leading to data leakage or database corruption.
Recommendation
Update the DP Calendar extension to a version newer than 10.11.2 that includes the fix for SQL injection.
Other vulnerabilities in DP Calendar
See all- CVE-2026-78071High
Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar.
- CVE-2026-57831High
The Joomla extension DP Calendar versions 8.18.0 through 10.11.2 is vulnerable to unauthenticated blind SQL injection. An attacker can send crafted queries without authentication.
Original NVD description (English source)
Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2 - Saving an article can trigger a blind SQL injection with content plugin, needs update permission for articles.