Which versions of DPCalendar are affected by CVE-2026-57831?

DPCalendar extension for Joomla contains an unauthenticated SQL injection vulnerability (CVSS 8.7) allowing remote attackers to directly extract database contents including user credentials, session…

How to fix or mitigate CVE-2026-57831?

Within 24 hours, inventory all systems running DPCalendar and document the installed version; flag affected instances as high-priority for remediation. Within 7 days, deploy Web Application Firewall rules to block SQL injection attack patterns, restrict the database user account to read-only permissions where possible, and enable database query logging with alerts for suspicious SQL syntax. Within 30 days, execute a migration plan-either remove DPCalendar entirely if not business-critical or replace it with a patched alternative calendar solution, as no vendor-released patch is identified at time of analysis.

DPCalendar CVE-2026-57831

Q: What is the CVSS score of CVE-2026-57831?

CVE-2026-57831 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-44599 HIGH

SQL Injection (CWE-89)

2026-07-15 Joomla

GHSA-r6gc-42q2-64m6

SQLi Dp Calendar Extension For Joomla

8.7

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated, low-complexity network SQLi (AV:N/AC:L/PR:N/UI:N) with data disclosure only, so C:H and I:N/A:N matching the stated confidentiality-only impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 08:45 vuln.today

CVE Published

Jul 15, 2026 - 08:08 cve.org

HIGH 8.7

DescriptionCVE.org

The Joomla extension DP Calendar is vulnerable to an unauthenticated SQL injection.

AnalysisAI

SQL injection in the DPCalendar extension for Joomla lets remote unauthenticated attackers inject arbitrary SQL through a vulnerable parameter, per the CVSS:4.0 vector (PR:N/UI:N). With confidentiality-only impact rated High and no integrity or availability effect, the flaw primarily enables theft of Joomla database contents such as user records, session data, and configuration secrets. No public exploit identified at time of analysis, and no EPSS or CISA KEV signal was provided.

Technical ContextAI

DPCalendar (Digital Peak) is a third-party calendaring/events extension installed on top of the Joomla CMS, which stores its data in a MySQL/MariaDB backend accessed via Joomla's database API. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input reaches a SQL query without proper parameterization or escaping - typically a component request parameter (e.g. a filter, id, or search value passed to a com_dpcalendar view) concatenated directly into a query. The affected product is identified by CPE cpe:2.3:a:digital-peak.com:dp_calendar_extension_for_joomla:*, with the version left as a wildcard indicating the affected range is not enumerated in the provided data.

RemediationAI

No vendor-released patch version identified at time of analysis - the only reference provided is the product page (https://joomla.digital-peak.com/products/dpcalendar), which does not cite a fixed release, so consult Digital Peak directly and upgrade to the latest DPCalendar version once a patched build is confirmed. As compensating controls until a patch is applied, deploy a WAF or Joomla security plugin with SQL-injection signatures in front of the com_dpcalendar endpoints, and restrict or disable public access to DPCalendar views (for example by taking the calendar offline or limiting it to authenticated users) - accepting the trade-off that this removes public calendar functionality. Additionally, ensure the Joomla database account used by the site has least-privilege grants to limit the data exposable via injection, and review database and web logs for anomalous query patterns against DPCalendar parameters.