iCagenda CVE-2026-67365

Exploitation requires that the iCagenda calendar module (mod_icagenda_calendar) is installed and published on a Joomla site and that its AJAX handler is reachable through com_ajax - the intended default deployment for sites using the calendar widget. Per the description, no session, CSRF token, or account is needed, so there is no authentication or user-interaction barrier. The limiting factors are: the specific extension and its calendar module must be present (sites without iCagenda are unaffected), the module must be published/exposed on the front end, and the CVSS AT:P metric indicates a specific injectable parameter or input condition must be met for the payload to reach the vulnerable query.

The signals point to a genuine priority rather than an inflated high-CVSS issue: the CVSS 4.0 vector is AV:N/AC:L/PR:N/UI:N (network, low complexity, no privileges, no user interaction), and the description independently confirms the 'no session, token or account' precondition, so the network/unauthenticated claim is corroborated by two sources. The one moderating metric is AT:P (attack requirements present), implying some condition on the injectable parameter, but this is a weak brake given the low complexity. EPSS data was not provided, and KEV status is negative, so there is no evidence of mass or active exploitation yet - this is exposure-driven risk, not observed-exploitation risk. The vendor-supplied subsequent-system impacts (SC:H/SI:H/SA:H) that drive the 9.2 appear aggressive for a web-app SQLi and should be treated cautiously; the primary, well-supported impact is confidentiality of the site database. No public exploit is identified at time of analysis, so weaponization risk is currently theoretical but low-effort given the flaw class.

An attacker sends a crafted unauthenticated HTTP request to the site's com_ajax endpoint targeting the iCagenda calendar module, embedding SQL syntax in a module parameter. Because no session or token is required, the request is processed and the injected SQL executes against the Joomla database, letting the attacker enumerate and exfiltrate data such as user records or session/config values. No public proof-of-concept is identified at time of analysis, but the low attack complexity means a working exploit would be straightforward to build.