Loading story…
A high-severity unauthenticated blind SQL injection vulnerability, tracked as CVE-2026-57831, was disclosed in the Joomla extension DP Calendar from Digital Peak. The flaw affects versions 8.18.0 through 10.11.2, is remotely exploitable without authentication, and carries a CVSS 4.0 score of 8.7, creating a risk of database compromise through crafted requests against exposed installations.
Advisory data recommends updating DP Calendar to a patched release and verifying that the update was successfully applied across affected Joomla environments. A separate Microsoft Security Update Guide entry for CVE-2026-56155 was also published, but the available record did not provide enough technical detail to establish a related product impact, exploitation path, or mitigation guidance.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-57831 was published for an unauthenticated blind SQL injection vulnerability affecting the Joomla extension DP Calendar versions 8.18.0 through 10.11.2. The issue is remotely exploitable without authentication and carries a CVSS 4.0 score of 8.7.
A Microsoft Security Response Center Security Update Guide entry exists for CVE-2026-56155, with Microsoft identified as the assigning CNA. The provided reference does not include substantive details about the vulnerability itself.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity SQL injection vulnerability tracked as **`CVE-2017-20263`** affects **Joomla! Component FocalPoint Pro/Free 1.2.3**. Public disclosures show that unauthenticated attackers can send crafted `GET` requests to `index.php` using `option=com_focalpoint`, `view=location`, and a malicious `id` value to inject arbitrary SQL commands through the component’s location view. The flaw was originally publicly documented without a CVE and later cataloged as remotely exploitable with **CVSS 4.0 8.8** and **CVSS 3.1 8.2** ratings. Successful exploitation could expose sensitive information stored in the backend database and may allow broader abuse depending on database permissions. Published guidance recommends updating the affected component, sanitizing the vulnerable `id` parameter, using parameterized queries, and limiting database account privileges to reduce impact if exploitation occurs.
Jun 29, 2026
A critical flaw in Joomla! tracked as **`CVE-2015-8562`** allowed unauthenticated attackers to achieve remote code execution by sending crafted HTTP headers, including **`User-Agent`**, to vulnerable sites. The bug affected Joomla! versions **`1.5.0` through `3.4.5`** and was fixed in **`3.4.6`**. Researchers reported that exploitation was already occurring in the wild before the patch was released, with attackers abusing Joomla!'s session handling to write malicious serialized data into the backend MySQL session store and trigger code execution on a follow-up request. The exploit chain relied on multiple conditions: Joomla! stored session data in MySQL text fields, MySQL could silently truncate input containing 4-byte UTF-8 characters under configurations such as **`utf8_general_ci`**, and PHP session decoding behavior associated with **`CVE-2015-6835`** could turn the truncated data into attacker-controlled objects. The injected object chain then reached Joomla! components including **`JDatabaseDriverMysqli`** and **`SimplePie`**, ultimately invoking dangerous code paths such as **`assert()`**. Recommended mitigations included upgrading Joomla! and PHP, applying distribution patches, using **`utf8mb4`** where appropriate, and enabling stricter MySQL SQL modes to prevent silent truncation.
Aug 15, 2026
Attacks targeting **Joomla!** vulnerability `CVE-2023-23752` increased sharply after the flaw was disclosed and patched, with MBSD-SOC first observing exploitation attempts on February 18 and reporting a further rise through March. The bug is an improper access control issue in Joomla! webservice endpoints that affects versions `4.0.0` through `4.2.7`, allowing unauthorized API access and exposure of sensitive information; researchers warned that successful exploitation could lead to site compromise. MBSD-SOC said attack volume climbed notably after March 8 as proof-of-concept exploit code became publicly available, with most observed traffic originating from the United States and increased activity also seen from Japan and Singapore. The Joomla! Project rated the issue **Critical** and released fixes in version `4.2.8`; defenders were advised to upgrade affected systems and change passwords in the global configuration because exposed credentials and configuration data could aid follow-on compromise.
Aug 15, 2026