The Joomla! component Zap Calendar Lite version 4.3.4 is vulnerable to an unauthenticated SQL injection that can be triggered through the 'eid' GET parameter of the RSVP plugin. An attacker can send crafted SQL payloads to this endpoint and execute arbitrary SQL statements, allowing the extraction of sensitive database information such as database names, table structures, and potentially other confidential data. The vulnerability is a classic example of CWE‑89 and could also enable further compromise if the database is used by other applications or services.

The affected product is the Zap Calendar Lite component provided by Zcontent for Joomla CMS. Only version 4.3.4 contains the flaw; no other product versions are listed in the CNA data.

The CVSS score of 8.8 indicates a high severity vulnerability. Exploitation requires only that an attacker can send an HTTP GET request to the component’s RSVP endpoint, so the attack vector is network‑based and unauthenticated. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Given the ease of exploitation and the potential for significant data exposure, the risk to affected installations remains high until the component is updated or otherwise mitigated.