CVE-2026-78070
MediumCVSS 6.9Summary
Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2. Saving an article can trigger a blind SQL injection with content plugin, needs update permission for articles.
Risk Assessment
An attacker with article update permissions can execute unauthorized database queries, potentially leading to data leakage or database corruption.
Recommendation
Update the DP Calendar extension to a version newer than 10.11.2 that includes the fix for SQL injection.
Other vulnerabilities in DP Calendar
See all- CVE-2026-78071High
The DP Calendar extension for Joomla (digital-peak.com) in versions 7.0.0-8.19.5 and 9.0.0-10.12.0 contains an authenticated, privileged stored XSS vulnerability. The location title is rendered in a data attribute without escaping, leading to XSS; create permission in DPCalendar is required.
- CVE-2026-57831High
The Joomla extension DP Calendar versions 8.18.0 through 10.11.2 is vulnerable to unauthenticated blind SQL injection. An attacker can send crafted queries without authentication.
Original NVD description (English source)
Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2 - Saving an article can trigger a blind SQL injection with content plugin, needs update permission for articles.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS