Articles Calendar
Affected versions: ≤ 1.0.1.0007
Full advisory: nvd.nist.gov
CVE-2025-26855CriticalPublished 18 July 2025
Articles Calendar (mod_articles_calendar) 1.0.1.0007 and below - Unauthenticated SQL Injection (Full Database Disclosure)
The Articles Calendar extension by JoomCar (joomcar.net), versions 1.0.0 through 1.0.1.0007, contains an SQL injection flaw reachable without authentication. An anonymous visitor can execute arbitrary SQL against the site database, which means full read access to every table including the Joomla user table and its password hashes. CVSS 9.8 (Critical). No fixed version has been published by the vendor. Remove the extension, or block access to it, until JoomCar ships a patched release. This rule covers the "Articles - Calendar" site module half of the package; the companion system plugin is covered by a separate rule on articlescalendar.
Affected versions: ≤ 1.0.1.0007
Official record: cve.org · NVD
Related vulnerabilities
Every connected Joomla site is checked against these rules on each audit, and flagged if it runs an affected version.
Affected extensions and versions
Articles Calendar - Articles Calendar (articlescalendar) 1.0.1.0007 and below - Unauthenticated SQL Injection (Full Database Disclosure)
The Articles Calendar extension by JoomCar (joomcar.net), versions 1.0.0 through 1.0.1.0007, contains an SQL injection flaw reachable without authentication. An anonymous visitor can execute arbitrary SQL against the site database, which means full read access to every table including the Joomla user table and its password hashes. CVSS 9.8 (Critical). No fixed version has been published by the vendor. Remove the extension, or block access to it, until JoomCar ships a patched release. This rule covers the "System - Articles Calendar" plugin half of the package; the companion site module is covered by a separate rule on mod_articles_calendar.
Affected versions: ≤ 1.0.1.0007
Full advisory: nvd.nist.gov
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
Rules current as of 25 August 2026.