Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.2
CVE-2026-67365: Joomla icagenda.com Extension Allows Unauthorized Access
CVE-2026-67365 · published 20 days ago
Summary
The Joomla icagenda.com extension has a security flaw that allows attackers to execute unauthorized database queries without logging in. This can lead to sensitive data exposure and unauthorized actions. Update the extension to version 4.0.12 or later to fix this issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| icagenda.com | icagenda extension for joomla | 4.0.0-4.0.11 |
Original advisory text
Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11
Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11 - Unauthenticated SQL injection in mod_icagenda_calendar (iCagenda), reachable via com_ajax with no session, token or account.
References
Severity
9.2
Critical
CVSS 4.0: 9.2 (NVD)
Exploitation
EPSS <1%
Type
CWE-89SQL Injection
Timeline
Published14 Aug 2026
Updated24 Aug 2026
First seen14 Aug 2026
Monitor software like this
Free during beta