CVE-2026-78071

DPCalendar Free のロケーションタイトルを介した格納型XSS DPCalendar Free ≤ 10.11.2 — Authorロールのユーザーがコンテンツレビューを迂回し、ロケーションタイトルを介して永続的XSSを注入。任意の訪問者がホバーした際に発動 -orange 概要 $location-title フィールドは、defaultlocations.php 内で htmlspecialchars を使用せずにレンダリングされます。Joomla のサーバーサイド InputFilter::clean は文字列フィールドから を除去しますが、"...

Exploit for CVE-2026-78071

Stored XSS via Location Title in DPCalendar Free DPCalendar...

CVE-2026-78071 Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

CVE-2026-78071

DP Calendar is a Joomla extension by digital-peak.com. Versions 7.0.0 through 10.11.2 are affected by an authenticated, privileged stored XSS . The root cause is that the location title is rendered in a data attribute without proper escaping. Exploitation requires an authenticated user with the c...

EUVD-2026-67653

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

PT-2026-83077

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

CVE-2026-78071: Improper Neutralization of Input During Web Page Generation

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...