Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.
iCagenda (com_icagenda) 4.0.8 to 4.0.11 - Unauthenticated SQL Injection (CVE-2026-67365), Authenticated SQL Injection, CSRF on Registration Actions and ACL Bypass User Enumeration (CVE-2026-71571, CVE-2026-67366, CVE-2026-71570)
iCagenda 4.0.8 through 4.0.11 (the Joomla 4/5/6 branch) contain an unauthenticated SQL injection in mod_icagenda_calendar, reachable through com_ajax with no session, token or account (CVE-2026-67365, CVSS 4.0 9.2 Critical). An anonymous visitor can read arbitrary database contents including Joomla user password hashes. This is a separate flaw from the earlier CVE-2026-48939 file upload RCE and was reported by Joep van Antwerpen of Onvio. Fixed in 4.0.12; update to 4.0.13 or later, which also fixes a stored XSS regression introduced in 4.0.8. The legacy Joomla 3 branch (3.9.x) is not affected by this SQL injection. Three further iCagenda CVEs published the same day are fixed in the same 4.0.12 release: CVE-2026-71571 (CVSS 4.0 8.6 High), an SQL injection through an unescaped numeric filter reachable by backend users with access to iCagenda; CVE-2026-67366 (5.3 Medium), missing CSRF token checks on several state-changing front-end registration actions; and CVE-2026-71570 (5.1 Medium), an ACL bypass that lets a backend operator scoped to com_icagenda enumerate Joomla user profiles.
Affected versions: ≥ 4.0.8 and < 4.0.12
Full advisory: www.icagenda.com
iCagenda (com_icagenda) below 4.0.8 - Unauthenticated Arbitrary File Upload (RCE) (CVE-2026-48939, CISA KEV)
iCagenda's frontend "Submit an Event" form (index.php?option=com_icagenda&task=submit.submit) accepts arbitrary file uploads with no server-side type check. The submitAccess access-level setting is enforced only in the view, not on the processing path, so a guest with a freely-harvested CSRF token can upload a .php web shell to a web-served, predictable path and execute it, effectively unauthenticated RCE. Confirmed exploited in the wild from 15 Jun 2026 (icagenda-batch/1.0 scanner). CVE-2026-48939, added to the CISA Known Exploited Vulnerabilities catalog on 10 Jul 2026. Fixed in 4.0.8 (JoomliC Critical Security Release, 15 Jun 2026); update immediately. If you cannot patch, rename the com_icagenda component folders, since unpublishing does not close the hole.
Affected versions: ≥ 4.0.0 and < 4.0.8
Full advisory: www.cve.org
iCagenda (com_icagenda) below 4.0.8 - Unauthenticated Arbitrary File Upload (RCE) (CVE-2026-48939, CISA KEV)
iCagenda's frontend "Submit an Event" form (index.php?option=com_icagenda&task=submit.submit) accepts arbitrary file uploads with no server-side type check. The submitAccess access-level setting is enforced only in the view, not on the processing path, so a guest with a freely-harvested CSRF token can upload a .php web shell to a web-served, predictable path and execute it, effectively unauthenticated RCE. Confirmed exploited in the wild from 15 Jun 2026 (icagenda-batch/1.0 scanner). CVE-2026-48939, added to the CISA Known Exploited Vulnerabilities catalog on 10 Jul 2026. Fixed in 4.0.8 (JoomliC Critical Security Release, 15 Jun 2026); update immediately. If you cannot patch, rename the com_icagenda component folders, since unpublishing does not close the hole.
Affected versions: ≥ 3.2.1 and < 3.9.15
Full advisory: our disclosure post
iCagenda (com_icagenda) below 4.0.17 (3.9.17 PRO on Joomla 3) - Stored XSS via URL Custom Field and CSV Formula Injection in Registrations Export
JoomliC released iCagenda 4.0.17 (Joomla 4, 5 and 6) and iCagenda PRO 3.9.17 (Joomla 3) on 27 October 2026 to fix two security issues. CVE-2026-102790, rated High by the vendor: the value of a url-type event custom field sent through the front-end event submission form was saved without validation and printed into a link with no escaping and no check on the link scheme, so a submitted event could carry JavaScript that runs in the browser of anyone who views it, including administrators. Submitting needs whatever access level the site gives the submission form, which is Registered by default and anonymous only where the site opened it to Public. CVE-2026-102799, rated Medium: the registrations CSV export did not neutralise cells beginning with = + - or @, so a name, email, note or custom field value entered on the registration form could run as a spreadsheet formula when an administrator opens the export. JoomliC lists 3.2.1 to 4.0.16 as affected by the XSS and 3.5.0 to 4.0.16 by the CSV injection. We confirmed both changes by comparing the public 4.0.16 and 4.0.17 packages. Reported by Akinlabi Omoogun of lulztigre.pw. Not a mySites.guru finding. Both CVE ids are reserved; the CVE records are not yet published. Update to 4.0.17 on Joomla 4, 5 or 6. On Joomla 3, 3.9.17 is available only with an iCagenda PRO subscription, because the free 3.9 line reached end of life on 13 October 2026; the lasting fix is to move the site to Joomla 5 or 6 and iCagenda 4.0.17. Until updated, disable the menu item for front-end event submission and do not open registration exports in a spreadsheet.
Affected versions: ≥ 4.0.0 and < 4.0.17
Full advisory: our disclosure post
iCagenda (com_icagenda) below 4.0.17 (3.9.17 PRO on Joomla 3) - Stored XSS via URL Custom Field and CSV Formula Injection in Registrations Export
JoomliC released iCagenda 4.0.17 (Joomla 4, 5 and 6) and iCagenda PRO 3.9.17 (Joomla 3) on 27 October 2026 to fix two security issues. CVE-2026-102790, rated High by the vendor: the value of a url-type event custom field sent through the front-end event submission form was saved without validation and printed into a link with no escaping and no check on the link scheme, so a submitted event could carry JavaScript that runs in the browser of anyone who views it, including administrators. Submitting needs whatever access level the site gives the submission form, which is Registered by default and anonymous only where the site opened it to Public. CVE-2026-102799, rated Medium: the registrations CSV export did not neutralise cells beginning with = + - or @, so a name, email, note or custom field value entered on the registration form could run as a spreadsheet formula when an administrator opens the export. JoomliC lists 3.2.1 to 4.0.16 as affected by the XSS and 3.5.0 to 4.0.16 by the CSV injection. We confirmed both changes by comparing the public 4.0.16 and 4.0.17 packages. Reported by Akinlabi Omoogun of lulztigre.pw. Not a mySites.guru finding. Both CVE ids are reserved; the CVE records are not yet published. Update to 4.0.17 on Joomla 4, 5 or 6. On Joomla 3, 3.9.17 is available only with an iCagenda PRO subscription, because the free 3.9 line reached end of life on 13 October 2026; the lasting fix is to move the site to Joomla 5 or 6 and iCagenda 4.0.17. Until updated, disable the menu item for front-end event submission and do not open registration exports in a spreadsheet.
Affected versions: ≥ 3.2.1 and < 3.9.17
Full advisory: our disclosure post
iCagenda (com_icagenda) 4.0.8 to 4.0.12 - Authenticated Stored XSS via Submit an Event (CVE-2026-75948)
iCagenda 4.0.8 to 4.0.12 store the image and file fields of the front-end Submit an Event form as raw strings and print them into HTML attributes without escaping, so a logged-in user allowed to submit events can store JavaScript that runs in the browser of anyone who views the event, administrators included. CVE-2026-75948, CVSS 4.0 8.6 High, published by the Joomla CNA on 20 August 2026. The flaw was introduced in 4.0.8 and fixed in 4.0.13. Update iCagenda to the current release (4.0.17 or later also closes the later stored XSS and CSV injection CVEs). Until then, restrict the Submit an Event menu item to trusted user groups and review submitted events for unexpected markup.
Affected versions: ≥ 4.0.8 and < 4.0.13
Full advisory: www.icagenda.com
Each CVE page above links its official cve.org record and its NVD entry.
Running iCagenda on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.
CVE identifiers: CVE-2026-67365, CVE-2026-71571, CVE-2026-67366, CVE-2026-71570, CVE-2026-48939, CVE-2026-102790, CVE-2026-102799, CVE-2026-75948. Rules current as of 15 November 2026.
