Joomla iCagenda < 3.9.10 - Unauthenticated Arbitrary File Upload RCE

iCagenda extension for Joomla contains an unrestricted file upload vulnerability in the file attachment feature, letting attackers upload and execute arbitrary PHP code, exploit requires no special privileges. id: CVE-2026-48939 info: name: Joomla iCagenda 3.9.10 - Unauthenticated Arbitrary File...

CVE-2026-48939

CVE-2026-48939 — iCagenda Joomla RCE Exploit Pre-Auth Arbitrary File Upload → PHP Code Execution Overview CVE-2026-48939 is a CVSS 10.0 critical vulnerability in the iCagenda events calendar extension for Joomla. The frontend event registration form's file attachment feature enforces access...

By-Poloss..-..CVE-2026-48939

CVE-2026-48939 - iCagenda Unauthenticated File Upload to RCE Overview Field| Value ---|--- CVE ID| CVE-2026-48939 CVSS 4.0 Score| 10.0 Critical CVSS Vector| CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CWE| CWE-284: Improper Access Control Affected Versions| iCagenda 3.2.1 -...

CVE-2026-87930

🌐 Language / Dil 📌 Özet Joomla Multi-CVE Suite — 7 zafiyet modülü + x7-panel.php deploy CVE| Eklenti ---|--- CVE-2026-56291| Balbooa Forms combaforms CVE-2026-56290| Page Builder CK compagebuilderck CVE-2026-48908| SP Page Builder comsppagebuilder CVE-2026-48907| JCE comjce CVE-2026-48939| iCagen...

CVE-2026-102790

Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16...

CVE-2026-102799

Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16...

CVE-2026-102790 Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12

Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16...

EUVD-2026-112028

Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16...

CVE-2026-102790

The iCagenda Joomla extension (versions 3.2.1 to 4.0.16 ) is vulnerable to Authenticated Stored XSS (CVE-2026-102790). The root cause is that a url-type event custom field submitted via the front-end event submission form is printed into a link without proper escaping or scheme validation. This a...

EUVD-2026-112025

Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16...

CVE-2026-102799: icagenda.com iCagenda extension for Joomla: Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16

Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16...

CVE-2026-102790: icagenda.com iCagenda extension for Joomla: Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16

Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16...

PT-2026-127210

Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16...

PT-2026-127211

Name of the Vulnerable Software and Affected Versions iCagenda versions 3.5.0 through 4.0.16 Description The registrations export feature in the iCagenda Joomla extension is susceptible to CSV formula injection. This occurs when untrusted input is included in a CSV export, allowing an attacker to...

CVE-2026-75948

Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the image and file fields as raw strings with no output-side HTML-attribute escaping...

EUVD-2026-63216

Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the image and file fields as raw strings with no output-side HTML-attribute escaping...

CVE-2026-75948 Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12

Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the image and file fields as raw strings with no output-side HTML-attribute escaping...

CVE-2026-75948 Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12

Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the image and file fields as raw strings with no output-side HTML-attribute escaping...

CVE-2026-75948

Authenticated stored XSS in iCagenda 4.0.8–4.0.12: the frontend "Submit an Event" form stores the image and file fields as raw strings without output-side HTML-attribute escaping. CVSS 8.6 HIGH (network, low privilege, passive user interaction). No exploitation details or patch version provided i...

CVE-2026-75948: Improper Neutralization of Input During Web Page Generation

Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the image and file fields as raw strings with no output-side HTML-attribute escaping...