CVE-2026-75948

Authenticated stored XSS in iCagenda 4.0.8–4.0.12: the frontend "Submit an Event" form stores the image and file fields as raw strings without output-side HTML-attribute escaping. CVSS 8.6 HIGH (network, low privilege, passive user interaction). No exploitation details or patch version provided i...