CVE-2026-78071

Stored XSS via Location Title in DPCalendar Free DPCalendar Free ≤ 10.11.2 — Author-Role User Bypasses Content Review to Inject Persistent XSS via Location Title, Triggered on Hover by Any Visitor -orange SUMMARY The $location-title field is rendered without htmlspecialchars in...

CVE-2026-78070

SQL Injection via ORDER BY Shortcode in plgcontentdpcalendar DPCalendar Free ≤ 10.11.2 — Author-level User Extracts Full Database via Time-Based Blind Injection SUMMARY The plgcontentdpcalendar content plugin parses events order="..."/events shortcodes embedded in Joomla article bodies. The order...

Exploit for CVE-2026-78071

Stored XSS via Location Title in DPCalendar Free DPCalendar...

Exploit for CVE-2026-78070

SQL Injection via ORDER BY Shortcode in plgcontentdpcalendar...

Joomla Security Breach

Joomla is an open source, cross-platform content management system CMS developed by the Open Source Matters team using PHP and MySQL. A security vulnerability exists in Joomla DPCalendar that stems from the presence of a cross-site scripting XSS vulnerability...