EUVD-2026-58806

Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda 2.0.0-4.0.11 - Multiple state changing operations in the frontend are callable without a CSRF token check...

EUVD-2026-58804

Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda 2.0.0-4.0.11 - Backend operators with permissions to access iCagenda could inject SQL...

EUVD-2026-58803

Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda 4.0.0-4.0.11 - Unauthenticated SQL injection in modicagendacalendar iCagenda, reachable via comajax with no session, token or account...

Joomla iCagenda < 3.9.10 - Unauthenticated Arbitrary File Upload RCE

iCagenda extension for Joomla contains an unrestricted file upload vulnerability in the file attachment feature, letting attackers upload and execute arbitrary PHP code, exploit requires no special privileges. id: CVE-2026-48939 info: name: Joomla iCagenda 3.9.10 - Unauthenticated Arbitrary File...

Joomla! Extension 'iCagenda' 3.2.1 < 3.9.15 / 4.x < 4.0.8 Arbitrary Files Upload

The version of the iCagenda extension for the Joomla! application running on the remote host is 3.2.1 prior to 3.9.15 or 4.x prior to 4.0.8. It is, therefore, affected by an arbitrary files upload vulnerability in the file attachment feature, ultimately resulting in PHP code upload and execution...

iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added two maximum-severity security flaws impacting iCagenda and Balbooa extensions for Joomla to its Known Exploited Vulnerabilities KEV catalog, following reports of zero-day exploitation in the wild. The vulnerabilities, both...

VulnCheck KEV: CVE-2026-48939

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution...

iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability

iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution...

📄 ICagenda 3.9.14 / 4.0.7 Shell Upload

iCagenda, a popular events and calendar component for Joomla, contains an unauthenticated file upload vulnerability that allows remote attackers to upload and execute arbitrary PHP code on Joomla 6 sites. Versions 3.2.1 through 3.9.14 and 4.0.0 through 4.0.7 are affected.:1 CVE-2026-48939 -...

CVE-2026-48939

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution...

CVE-2026-48939 Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution...

CVE-2026-48939 Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution...

CVE-2026-48939

The CVE-2026-48939 issue affects iCagenda/Joomla. The vulnerability is in the frontend event submission form’s file attachment feature, where missing access control and lack of file validation allow unauthenticated uploads that are written to a web‑accessible directory and can be executed as PHP,...

EUVD-2026-38109

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution...

PT-2026-51137

Name of the Vulnerable Software and Affected Versions iCagenda versions prior to 4.0.8 iCagenda versions prior to 3.9.15 Description A flaw in the iCagenda extension for Joomla allows unauthenticated users to upload arbitrary files through the attachment feature of the public event submission for...

Joomla iCagenda 3.5.15 XSS vulnerability

No description provided by source...

Joomla iCagenda 3.5.15 Cross Site Scripting

Exploit Title : Joomla iCagenda Cross Site Scripting Vulnerability Exploit Author : Persian Hack Team Vendor Homepage : http://extensions.joomla.org/extension/calendars-a-events/icagenda Google Dork : inurl:index.php?option=comicagenda Date: 2016/03/22 Version: 3.5.5 up to 3.5.15 Payload : " Demo...

Joomla iCagenda Component - (id parameter) Multiple Vulnerabilities

No description provided by source. Souhail Hammou - Independant Security Researcher & Penetration Tester . Facebook : www.facebook.com/dark.puzzle.sec E-mail : [email protected] Greetings to all moroccan researchers and white hats...

Joomla! Component com_icagenda - id Multiple Vulnerabilities

Joomla! Component comicagenda - id Multiple Vulnerabilities Souhail Hammou - Independant Security Researcher & Penetration Tester . Facebook : www.facebook.com/dark.puzzle.sec E-mail : [email protected] Greetings to all moroccan researchers and white hats...

Joomla iCagenda SQL Injection / Path Disclosure

Souhail Hammou - Independant Security Researcher & Penetration Tester . Facebook : www.facebook.com/dark.puzzle.sec E-mail : [email protected] Greetings to all moroccan researchers and white hats . ------------------------------------------------------------------------------ Exploit Title:...