CVE-2026-67365

CVSS 9.2 (critical) · published 2026-08-14

Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11 - Unauthenticated SQL injection in mod_icagenda_calendar (iCagenda), reachable via com_ajax with no session, token or account.

Weakness: CWE-89

Source: NVD CVE-2026-67365

References

• https://www.icagenda.com/

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.