Downloads

Release Notes 4.0.12
! Critical Security Release and Medium to Low-Medium security fixes and hardenings.
# [SECURITY][CVE-2026-67365][CRITICAL] Fixed: Unauthenticated SQL injection via mod_icagenda_calendar / com_ajax.
   This vulnerability was responsibly reported by Joep van Antwerpen of Onvio.
   I thank Joep for responsibly reporting this issue and helping me improve the security of iCagenda.
# [SECURITY][CVE-2026-67366][MEDIUM] Fixed: CSRF on frontend registration actions.
# [SECURITY][CVE-2026-71570][MEDIUM] Fixed: ACL bypass allowing arbitrary Joomla user enumeration (admin-only).
# [SECURITY][CVE-2026-71571][MEDIUM] Fixed: SQL injection risk via unescaped numeric filter (admin-only).
~ [SECURITY] Hardening: Hardening output escaping for venue/city/country/address.

Changed Files in 4.0.12
~ com_icagenda/admin/src/Controller/RegistrationController.php
~ com_icagenda/admin/src/Model/EventsModel.php
~ com_icagenda/site/src/Assets/EventShortcuts.php
~ com_icagenda/site/src/Assets/ListShortcuts.php
~ com_icagenda/site/src/Controller/RegistrationController.php
~ com_icagenda/site/tmpl/registration/actions.php
~ [MODULE] mod_icagenda_calendar/media/joomla.asset.json
~ [MODULE] mod_icagenda_calendar/media/js/icagenda-calendar.js
~ [MODULE] mod_icagenda_calendar/src/Helper/IcagendaCalendarHelper.php
~ [MODULE] mod_icagenda_calendar/tmpl/default.php