CVE-2025-49468: Joomla Extension - nobossextensions.com - SQL injection vulnerability in No Boss Calendar component before 5.0.7 for Joomla

Severity: high (CVSS 8.6 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-06-13 · updated 2026-06-17
Weakness: CWE-89

Description

A SQL injection vulnerability in No Boss Calendar component before 5.0.7 for Joomla was discovered. The vulnerability allows remote authenticated users to execute arbitrary SQL commands via the id_module parameter.

Affected products

nobossextensions.com No Boss Calendar component for Joomla: 1.0.0-5.0.6

References

https://nobossextensions.com/

Get alerted when CVE-2025-49468 or the next vulnerability affects your stack