Security
Critical SQL injection fixed in Joomla iCagenda module
A critical, unauthenticated SQL injection affects the iCagenda Calendar module for Joomla, with administrators urged to update to version 4.0.12.
The Joomla project’s CVE Numbering Authority published CVE-2026-67365 on 14 August 2026. The issue affects the Calendar module, mod_icagenda_calendar, shipped with the iCagenda events extension from vendor JoomliC (icagenda.com).
mySites.guru reported that the flaw is a CWE-89 SQL injection reachable through Joomla’s com_ajax endpoint without an account, session or token. The official CVSS 4.0 score is 9.2, rated Critical. The advisory does not publish an exploit; it credits Joep van Antwerpen of Onvio as the finder.
- Affected: iCagenda
4.0.0through4.0.11 - Fixed:
4.0.12and later
Administrators should update the iCagenda package and confirm that the Calendar module itself reports 4.0.12. The module version may remain at 4.0.7 on packages up to 4.0.11, so checking only the component version can be misleading. If an immediate update is impossible, unpublish or uninstall the Calendar module as a temporary measure.
Originally reported by mySites.guru.