EUVD-2026-58803
GHSA-8xg9-r7w8-pqrr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network SQLi with low complexity (AV:N/AC:L/PR:N/UI:N); confidentiality high from database read, integrity/availability limited, scope unchanged as impact stays within the CMS database.
Primary rating from Vendor (joomla).
CVSS VectorVendor: joomla
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11 - Unauthenticated SQL injection in mod_icagenda_calendar (iCagenda), reachable via com_ajax with no session, token or account.
AnalysisAI
SQL injection in the iCagenda event-management extension for Joomla lets remote unauthenticated attackers inject arbitrary SQL through the mod_icagenda_calendar calendar module, which is reachable via Joomla's com_ajax endpoint without any session, CSRF token, or user account. Affected versions run from 4.0.0 through 4.0.11, and the CVSS 4.0 base score of 9.2 (Critical) reflects high confidentiality impact with additional integrity and availability effects. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the iCagenda calendar module (mod_icagenda_calendar) is installed and published on a Joomla site and that its AJAX handler is reachable through com_ajax - the intended default deployment for sites using the calendar widget. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals point to a genuine priority rather than an inflated high-CVSS issue: the CVSS 4.0 vector is AV:N/AC:L/PR:N/UI:N (network, low complexity, no privileges, no user interaction), and the description independently confirms the 'no session, token or account' precondition, so the network/unauthenticated claim is corroborated by two sources. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade iCagenda to a fixed release beyond the affected 4.0.0-4.0.11 range; the input does not state an exact fixed version, so the released patched version is not independently confirmed - consult the vendor at https://www.icagenda.com/ for the current release before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Joomla instances and identify those running iCagenda extension versions 4.0.0 through 4.0.11 to assess exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today