Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Vendor: icagenda.com Clear all filters
TI-2026-81945 CVE-2026-102790 · GHSA-pfmp-23x9-8m76

Stored cross-site scripting in iCagenda Joomla extension

Priority LOW 39

Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16

CVSS 4.0HIGH 8.6 Network Low privileges User interaction EPSS 0.00284 Published 2026-10-28 No fix listed CWE-79
TI-2026-81946 CVE-2026-102799 · GHSA-8ww4-2p6w-9hcc

CSV formula injection in iCagenda Joomla extension exports

Priority LOW 24

Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00288 Published 2026-10-28 No fix listed CWE-1236
TI-2026-53168 CVE-2026-75948 · GHSA-wpv7-x588-92g9

Cross-site scripting in icagenda.com iCagenda extension for Joomla

Priority LOW 39

Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the `image` and `file` fields as raw strings with no output-side HTML-attribute escaping…

CVSS 4.0HIGH 8.6 Network Low privileges User interaction EPSS 0.0039 Published 2026-08-20 No fix listed CWE-79
TI-2026-47662 CVE-2026-67366 · GHSA-q2h5-882x-32hv

Cross-site request forgery in icagenda.com iCagenda extension for Joomla

Priority LOW 23

Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda < 2.0.0-4.0.11 - Multiple state changing operations in the frontend are callable without a CSRF token check.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00214 Published 2026-08-14 No fix listed CWE-352
TI-2026-50139 CVE-2026-71570 · GHSA-p6wp-p37f-5vjh

Improper access control in icagenda.com iCagenda extension for Joomla

Priority LOW 23

Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11 - A backend operator granted access scoped to `com_icagenda` only could enumerate Joomla user profiles.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00412 Published 2026-08-14 No fix listed CWE-284
TI-2026-50140 CVE-2026-71571 · GHSA-64cq-v4q5-vx8r

SQL injection in icagenda.com iCagenda extension for Joomla

Priority LOW 39

Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.11 - Backend operators with permissions to access iCagenda could inject SQL.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00369 Published 2026-08-14 No fix listed CWE-89
TI-2026-47661 CVE-2026-67365 · GHSA-8xg9-r7w8-pqrr

SQL injection in icagenda.com iCagenda extension for Joomla

Priority MEDIUM 40

Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11 - Unauthenticated SQL injection in mod_icagenda_calendar (iCagenda), reachable via com_ajax with no session, token or account.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00386 Published 2026-08-14 No fix listed CWE-89