Critical severity · published Aug 14, 2026
CVE-2026-67365
Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11
9.2
CVSS
0.4%
EPSS
No
On KEV
Description
Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11 - Unauthenticated SQL injection in mod_icagenda_calendar (iCagenda), reachable via com_ajax with no session, token or account.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IE
iCagenda extension for Joomla · icagenda.com
4.0.0-4.0.11 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-67365
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-67365
www.icagenda.com
https://www.icagenda.com/
More from iCagenda extension for Joomla
9.8
CVE-2026-48939
Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15
8.6
CVE-2026-102790
Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12
8.6
CVE-2026-75948
Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12
8.6
CVE-2026-71571
Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.11
5.3
CVE-2026-102799
Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16