CVE-2026-74251 Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6

Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a attribute and s specification GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An...

CVE-2026-71570

Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration 2.0.0-4.0.11 - A backend operator granted access scoped to comicagenda only could enumerate Joomla user profiles...

CVE-2026-67366

Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda 2.0.0-4.0.11 - Multiple state changing operations in the frontend are callable without a CSRF token check...

CVE-2026-71571

Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda 2.0.0-4.0.11 - Backend operators with permissions to access iCagenda could inject SQL...

CVE-2026-67365

Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda 4.0.0-4.0.11 - Unauthenticated SQL injection in modicagendacalendar iCagenda, reachable via comajax with no session, token or account...

EUVD-2026-58806

Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda 2.0.0-4.0.11 - Multiple state changing operations in the frontend are callable without a CSRF token check...

CVE-2026-67366 Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda < 2.0.0-4.0.11

Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda 2.0.0-4.0.11 - Multiple state changing operations in the frontend are callable without a CSRF token check...

CVE-2026-67366

CVE-2026-67366 : The Joomla Extension icagenda.com (iCagenda) prior to 2.0.0-4.0.11 is affected by a CSRF issue on frontend registration actions. Multiple state-changing frontend operations can be triggered without a CSRF token check, enabling unauthorized changes. The CVSSv4 base score is 5.3 (M...

CVE-2026-67366 Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda < 2.0.0-4.0.11

Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda 2.0.0-4.0.11 - Multiple state changing operations in the frontend are callable without a CSRF token check...

CVE-2026-71570 Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11

Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration 2.0.0-4.0.11 - A backend operator granted access scoped to comicagenda only could enumerate Joomla user profiles...

CVE-2026-71570 Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11

Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration 2.0.0-4.0.11 - A backend operator granted access scoped to comicagenda only could enumerate Joomla user profiles...

EUVD-2026-58805

Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration 2.0.0-4.0.11 - A backend operator granted access scoped to comicagenda only could enumerate Joomla user profiles...

CVE-2026-71570

CVE-2026-71570 affects the Joomla Extension icagenda.com, where an ACL bypass in versions prior to 2.0.0-4.0.11 lets a backend operator scoped to com_icagenda enumerate Joomla user profiles. The vulnerability is rooted in improper access control between the backend scope and user profile data. Do...

CVE-2026-71571 Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.11

Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda 2.0.0-4.0.11 - Backend operators with permissions to access iCagenda could inject SQL...

CVE-2026-71571

Technical details are not publicly available in the provided documents. Monitor for updates from official sources.

CVE-2026-71571 Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.11

Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda 2.0.0-4.0.11 - Backend operators with permissions to access iCagenda could inject SQL...

EUVD-2026-58804

Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda 2.0.0-4.0.11 - Backend operators with permissions to access iCagenda could inject SQL...

CVE-2026-67365 Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11

Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda 4.0.0-4.0.11 - Unauthenticated SQL injection in modicagendacalendar iCagenda, reachable via comajax with no session, token or account...

CVE-2026-67365

CVE-2026-67365 affects the Joomla extension icagenda.com (iCagenda) with SQL injection in the module/mod_icagenda_calendar prior to version 4.0.0-4.0.11. The vulnerability is unauthenticated and reachable via com_ajax with no session, token, or account required. Impact is described as high confid...

CVE-2026-67365 Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11

Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda 4.0.0-4.0.11 - Unauthenticated SQL injection in modicagendacalendar iCagenda, reachable via comajax with no session, token or account...