Affected versions: ≥ 9.0.0 and < 10.11.2
Full advisory: our disclosure post
CVE-2026-57831HighPublished 13 July 2026
DPCalendar (com_dpcalendar) 9.0 to 10.11.1 (Joomla 4 to 6) - Unauthenticated Blind SQL Injection
DPCalendar on the Joomla 4 to 6 line (9.x and 10.x) contains an unauthenticated blind SQL injection in the front-end events model. The filter_created_by request parameter is placed into the events query without an integer cast (site EventsModel::getListQuery), so an anonymous visitor can inject boolean conditions and read arbitrary database contents including user password hashes and the Joomla secret through the public events feed at index.php?option=com_dpcalendar&view=events&format=raw. No login, token or CSRF is required. It is a read-only injection (no write or RCE). All editions (Free, Pro, Business) share the vulnerable site model. The flaw dates to 8.18.0 and affects every current-line release up to and including 10.11.0. Fixed in 10.11.2, which integer-casts the author filter. Update to 10.11.2 or later; on the 9.x line the upgrade path is 9.x to 10.0.0, then 10.6.0, then 10.11.2. Joomla 3 (8.x) sites are handled by a separate rule (fixed in 8.19.4). Temporary mitigation: block non-numeric filter_created_by at the WAF, or unpublish DPCalendar front-end menu items. Discovered and reported by mySites.guru.
Affected versions: ≥ 9.0.0 and < 10.11.2
Official record: cve.org · NVD
Related vulnerabilities
Every connected Joomla site is checked against these rules on each audit, and flagged if it runs an affected version.
Affected extensions and versions
DPCalendar - DPCalendar (com_dpcalendar) 8.18.0 to 8.19.3 (Joomla 3) - Unauthenticated Blind SQL Injection
DPCalendar on the Joomla 3 (8.x) branch contains an unauthenticated blind SQL injection in the front-end events model. The filter_created_by request parameter is placed into the events query without an integer cast (site EventsModel::getListQuery), so an anonymous visitor can inject boolean conditions and read arbitrary database contents including user password hashes and the Joomla secret through the public events feed at index.php?option=com_dpcalendar&view=events&format=raw. No login, token or CSRF is required. It is a read-only injection (no write or RCE). All editions (Free, Pro, Business) share the vulnerable site model. The flaw was introduced in 8.18.0 and affects every 8.x release from 8.18.0 up to 8.19.3. Fixed in 8.19.4, which integer-casts the author filter. Update to 8.19.4 or later, or migrate to Joomla 4 to 6 and DPCalendar 10.11.2. Joomla 4 to 6 (9.x and 10.x) sites are handled by a separate rule (fixed in 10.11.2). Temporary mitigation: block non-numeric filter_created_by at the WAF, or unpublish DPCalendar front-end menu items. Discovered and reported by mySites.guru.
Affected versions: ≥ 8.18.0 and < 8.19.4
Full advisory: our disclosure post
Our disclosure post
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
Rules current as of 25 August 2026.