This CVE in the iCagenda extension for Joomla involves SQL injection through the events manager, and the 'unescaped numeric filter' framing in the description masks something more systemic: the PHP/MySQL ecosystem has a fifteen-year history of presenting type-casting or simple filter functions as security controls, then framing their failure as developer error rather than design failure.
The authenticated prerequisite creates a misleading sense of safety. In Joomla deployments with iCagenda, backend access is typically granted to content managers, event coordinators, and marketing staff — numerous users with low security posture who often access systems from personal devices. An EPSS score of 0.00218 treats authentication as a meaningful gate, but for calendar extensions used by non-technical teams, it's functionally closer to unauthenticated access than defenders assume.
Three things you should verify in your environment. First, check whether any third-party extensions are using custom string-manipulation functions they believe are equivalent to framework filters — the actual vulnerability may stem from an absent or misused protection call rather than a broken one. Second, audit your backend user population for iCagenda specifically; if dozens of content-team accounts exist with event management permissions, treat the SQL injection risk as if it were unauthenticated. Third, investigate whether the filter mechanism referenced in the CVE was deprecated silently — security functions that persist in documentation and tutorials while their guarantees erode are a known failure mode in CMS extension ecosystems, and a 2019 tutorial may be producing vulnerable code on a 2024 codebase.
The commercial vendor economics matter here too. iCagenda is a paid extension, and low EPSS scores function as disinvestment signals that reduce remediation urgency. Your organization may be relying on vendor patches that face structural disincentives to arrive quickly. Consider whether you have independent capability to audit and patch third-party extension code rather than waiting for vendor releases.