The vulnerable component Calendar Planner 1.0.1 within Joomla! allows unauthenticated attackers to inject arbitrary SQL via the category_id field presented in GET requests to the events view. Because the input is not sanitized, an attacker can modify the query to read or manipulate any table in the Joomla! database, leading to sensitive data exposure. The vulnerability is classified as CWE‑89 and has a CVSS score of 8.8, reflecting high severity and a non‑negligible potential impact on confidentiality.

Affected systems include any Joomla! installation that has the Calendar Planner 1.0.1 component installed. The issue is limited to that specific version; later releases (if available) are presumed patched. No other products are listed as affected.

The risk level is high, as the flaw can be triggered with a simple HTTP GET request from any remote host, requiring no authentication. While the EPSS score is not publicly available, the CVSS indicates that a successful exploit would allow data exfiltration without compromise of other system components. The vulnerability is not currently listed in CISA’s KEV catalog, but its high score and public exploit evidence suggest that it should be treated as a likely target by threat actors.