Product Referenceproduct
https://extensions.joomla.org/extensions/extension/calendars-a-events/events/zap-calendar-lite CVE-2017-20268
HIGH
Joomla! Component Zap Calendar Lite 4.3.4 SQL Injection
Record summary
CVE-2017-20268 has a selected CVSS score of 8.8 (high); EIP currently links 1 catalogued exploit.
Description
Joomla! Component Zap Calendar Lite 4.3.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'eid' parameter. Attackers can send GET requests to the RSVP plugin endpoint with crafted SQL payloads to extract sensitive database information including database names and table structures.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 23, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Zap Calendar LiteBrowse Zcontent / Zap Calendar Lite | CVE List | 4.3.4 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBJoomla! Component Zap Calendar Lite 4.3.4 - SQL InjectionExploitDB exploitby Ihsan SencanNot analyzed1 file
References
5nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2017-20268 ExploitDB-42500exploit
https://www.exploit-db.com/exploits/42500 VulnCheck Advisory: Joomla! Component Zap Calendar Lite 4.3.4 SQL InjectionThird-party advisory
https://www.vulncheck.com/advisories/joomla-component-zap-calendar-lite-sql-injection Official Product Homepageproduct
https://zcontent.net/