Vulnerability Analysis

Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11

CVE-2026-67365

Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11 - Unauthenticated SQL injection in mod_icagenda_calendar (iCagenda), reachable via com_ajax with no session, token or account.

Injection No Active Exploit Signals

CVSS Base Score

9.2

CRITICAL

Exploitability:-

Impact Score:-

Temporal Score:-

EPSS:-

Threat Intelligence Signals

CISA KEV

KEV Date Added

—

Ransomware Use

—

KEV Due Date

—

VulnCheck In-the-Wild

Nuclei Template

EPSS Score

—

EPSS Percentile

—

GHSA ID

GHSA-8xg9-r7w8-pqrr ↗

GitHub Severity

CRITICAL

SSVC Exploitation

—

SSVC Automatable

—

Vulnerability Class

Injection

CVSS Vector Details

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality

Integrity

Availability

Identity & Timeline

Status	-
Assigning Authority	-
CVSS Version / Source	-
Reserved	-
Published	-
Patch Date (date_public)	-
Exploit DB Date	-
First GitHub PoC Date	-
Last Updated	-
Time to Patch (Days to fix)	-
Exploit Release Gap	-
PoC Release Gap	-
Exploit DB References	None identified

Weaknesses (CWE)

CISA SSVC Prioritization

MITRE ATT&CK Mapping

Tactics

Techniques

Exploitation & Remediation

Affected Products & Versions

Vendor	Product	Affected Versions
No affected products specified.

References

NVD Listing ↗ MITRE Listing ↗

No reference links found.