Dp Calendar Extension For Joomla
Monthly
Stored XSS in DP Calendar for Joomla (versions 7.0.0 through 10.11.2) allows authenticated users holding the DPCalendar 'create' permission to inject persistent malicious script by submitting an unsanitized Location title, which is rendered into an HTML data attribute without output encoding. Any Joomla site visitor who subsequently loads a calendar page containing the poisoned entry will execute the attacker-controlled payload in their browser, enabling session hijacking or unauthorized actions on their behalf. No public exploit code and no active exploitation have been identified at time of analysis.
Blind SQL injection in the DP Calendar Joomla extension (versions 5.5.0 through 10.11.2) enables authenticated users holding article update permissions to extract Joomla database contents by saving a crafted article when the DP Calendar content plugin is active. Reported by the Joomla security team and scored CVSS 4.0 6.9, the flaw yields high confidentiality impact but is constrained by a high-privilege prerequisite. No public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in the DPCalendar extension for Joomla lets remote unauthenticated attackers inject arbitrary SQL through a vulnerable parameter, per the CVSS:4.0 vector (PR:N/UI:N). With confidentiality-only impact rated High and no integrity or availability effect, the flaw primarily enables theft of Joomla database contents such as user records, session data, and configuration secrets. No public exploit identified at time of analysis, and no EPSS or CISA KEV signal was provided.
Stored XSS in DP Calendar for Joomla (versions 7.0.0 through 10.11.2) allows authenticated users holding the DPCalendar 'create' permission to inject persistent malicious script by submitting an unsanitized Location title, which is rendered into an HTML data attribute without output encoding. Any Joomla site visitor who subsequently loads a calendar page containing the poisoned entry will execute the attacker-controlled payload in their browser, enabling session hijacking or unauthorized actions on their behalf. No public exploit code and no active exploitation have been identified at time of analysis.
Blind SQL injection in the DP Calendar Joomla extension (versions 5.5.0 through 10.11.2) enables authenticated users holding article update permissions to extract Joomla database contents by saving a crafted article when the DP Calendar content plugin is active. Reported by the Joomla security team and scored CVSS 4.0 6.9, the flaw yields high confidentiality impact but is constrained by a high-privilege prerequisite. No public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in the DPCalendar extension for Joomla lets remote unauthenticated attackers inject arbitrary SQL through a vulnerable parameter, per the CVSS:4.0 vector (PR:N/UI:N). With confidentiality-only impact rated High and no integrity or availability effect, the flaw primarily enables theft of Joomla database contents such as user records, session data, and configuration secrets. No public exploit identified at time of analysis, and no EPSS or CISA KEV signal was provided.