CVE-2026-78070: Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2

Q: Who can exploit this issue?

An attacker needs authenticated, privileged access with permission to update Joomla articles. The issue is triggered when saving an article with the affected content plugin.

Q: Which DP Calendar versions are affected?

DP Calendar versions 5.5.0 through 10.11.2 are identified as affected.

Published Aug 28, 2026

Updated

Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2 - Saving an article can trigger a blind SQL injection with content plugin, needs update permission for articles.

Affected Software

1 affected component

Joomla DP Calendar>=5.5.0<=10.11.2

Event History

Aug 28, 2026

CVE Published

via MITRE·07:41 AM

Data Sourced

via MITRE·07:41 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs authenticated, privileged access with permission to update Joomla articles. The issue is triggered when saving an article with the affected content plugin.

Which DP Calendar versions are affected?

DP Calendar versions 5.5.0 through 10.11.2 are identified as affected.