# Articles Calendar (mod_articles_calendar) 1.0.1.0007 and below - Unauthenticated SQL Injection (Full Database Disclosure) [Joomla Vulnerability Database](https://mysites.guru/vulnerabilities/)/CVE-2025-26855 CVE-2025-26855CriticalCVSS 9.8CVE published 18 July 2025Added to mySites.guru 18 July 2025 # Articles Calendar (mod\_articles\_calendar) 1.0.1.0007 and below - Unauthenticated SQL Injection (Full Database Disclosure) The Articles Calendar extension by JoomCar (joomcar.net), versions 1.0.0 through 1.0.1.0007, contains an SQL injection flaw reachable without authentication. An anonymous visitor can execute arbitrary SQL against the site database, which means full read access to every table including the Joomla user table and its password hashes. CVSS 9.8 (Critical). No fixed version has been published by the vendor. Remove the extension, or block access to it, until JoomCar ships a patched release. This rule covers the "Articles - Calendar" site module half of the package; the companion system plugin is covered by a separate rule on articlescalendar. Copy citation ## Is my site affected? CVE-2025-26855 is checked by 2 rules. Find the extension and release line your site runs: Extension Affected versions Fixed in What to do Articles Calendar up to and including 1.0.1.0007 after 1.0.1.0007 Update Articles Calendar to the newest release from the vendor. This flaw covers versions up to 1.0.1.0007, so any later release is outside it. Articles Calendar up to and including 1.0.1.0007 after 1.0.1.0007 Update Articles Calendar to the newest release from the vendor. This flaw covers versions up to 1.0.1.0007, so any later release is outside it. [Check whether your sites are affected](https://mysites.guru/free-audit/) ## How CVE-2025-26855 is scored The base metrics as CISA-ADP published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw. 9.8 Critical CVSS 3.1, scored by CISA-ADP `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` ### How it is reached - **AV:N Attack vector** - Network. Reachable across the internet - **AC:L Attack complexity** - Low. Nothing to work around, it just works - **PR:N Privileges required** - None. No account needed - **UI:N User interaction** - None. Nobody has to be tricked into anything - **S:U Scope** - Unchanged. Contained to the extension it is in ### What it does - **C:H Confidentiality** - High. Everything the site holds can be read - **I:H Integrity** - High. Data and files can be altered at will - **A:H Availability** - High. The site can be taken down ## Timeline 1. 18 July 2025CVE-2025-26855 record published by its CNA 2. 18 July 2025mySites.guru check added for Articles Calendar (up to and including 1.0.1.0007) 3. 18 July 2025mySites.guru check added for Articles Calendar (up to and including 1.0.1.0007) ## Rule details Critical[CVE-2025-26855](https://mysites.guru/vulnerabilities/CVE-2025-26855/)2025-07-18 Articles Calendar Affected versions: ≤ 1.0.1.0007 Full advisory: [nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-26855) Critical[CVE-2025-26855](https://mysites.guru/vulnerabilities/CVE-2025-26855/)2025-07-18 Articles Calendar - Articles Calendar (articlescalendar) 1.0.1.0007 and below - Unauthenticated SQL Injection (Full Database Disclosure) The Articles Calendar extension by JoomCar (joomcar.net), versions 1.0.0 through 1.0.1.0007, contains an SQL injection flaw reachable without authentication. An anonymous visitor can execute arbitrary SQL against the site database, which means full read access to every table including the Joomla user table and its password hashes. CVSS 9.8 (Critical). No fixed version has been published by the vendor. Remove the extension, or block access to it, until JoomCar ships a patched release. This rule covers the "System - Articles Calendar" plugin half of the package; the companion site module is covered by a separate rule on mod\_articles\_calendar. Affected versions: ≤ 1.0.1.0007 Full advisory: [nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-26855) ## References - [CVE-2025-26855 on cve.org (the official CVE record)](https://www.cve.org/CVERecord?id=CVE-2025-26855) - [CVE-2025-26855 in the NIST National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2025-26855) ## CVE-2025-26855 questions Show all Which versions are affected by CVE-2025-26855? [CVE-2025-26855](https://mysites.guru/vulnerabilities/CVE-2025-26855/) is covered by 2 rules: Articles Calendar up to and including 1.0.1.0007; Articles Calendar up to and including 1.0.1.0007. How do I fix CVE-2025-26855? It depends on the extension and release line your site runs. For Articles Calendar up to and including 1.0.1.0007: update Articles Calendar to the newest release from the vendor. This flaw covers versions up to 1.0.1.0007, so any later release is outside it. For Articles Calendar up to and including 1.0.1.0007: update Articles Calendar to the newest release from the vendor. This flaw covers versions up to 1.0.1.0007, so any later release is outside it. How severe is CVE-2025-26855? CISA-ADP scores it 9.8 (Critical) under CVSS 3.1. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything. ## Running an affected version on a site you manage? A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, [fix.mysites.guru](https://fix.mysites.guru/) is a single fixed fee per incident, usually resolved the same day. This check is part of the [mySites.guru Joomla vulnerability scanner](https://mysites.guru/joomla-vulnerability-scanner/), which reads every installed extension's version on each audit. Browse the rest of the [Joomla vulnerability database](https://mysites.guru/vulnerabilities/). Rules current as of 14 October 2026.