Unauthenticated Blind SQL Injection Disclosed in Joomla DP Calendar
Vulnerability Disclosure · 2 sources · Updated 3mo ago · First seen Jul 15, 2026
A high-severity unauthenticated blind SQL injection vulnerability, tracked as CVE-2026-57831, was disclosed in the Joomla extension DP Calendar from Digital Peak. The flaw affects versions 8.18.0 through 10.11.2, is remotely exploitable without authentication, and carries a CVSS 4.0 score of 8.7, creating a risk of database compromise through crafted requests against exposed installations.
Advisory data recommends updating DP Calendar to a patched release and verifying that the update was successfully applied across affected Joomla environments. A separate Microsoft Security Update Guide entry for CVE-2026-56155 was also published, but the available record did not provide enough technical detail to establish a related product impact, exploitation path, or mitigation guidance.
