Icagenda Extension For Joomla
Monthly
Stored cross-site scripting in iCagenda Joomla extension versions 4.0.8 through 4.0.12 allows an authenticated event submitter to inject persistent JavaScript payloads via the `image` and `file` fields of the frontend 'Submit an Event' form. The injected script executes in any viewer's browser upon rendering the affected event page, with highest consequence when a Joomla administrator previews or approves the submission, enabling session hijacking and full backend compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the stored nature of this XSS elevates risk above reflected variants due to its persistence and elevated-privilege victim profile.
Cross-site request forgery in the iCagenda Joomla extension (versions prior to 4.0.11) exposes multiple frontend state-changing operations - including event registration actions - to forged HTTP requests, because no CSRF token validation is applied to those endpoints. Any Joomla site running a vulnerable iCagenda release allows an attacker to trigger registrations or other frontend mutations on behalf of an authenticated visitor who is socially engineered into loading a crafted page. No public exploit has been identified at time of analysis, and the vendor has addressed the issue in version 4.0.11.
Access control bypass in the iCagenda Event Scheduler Extension for Joomla (all versions prior to 4.0.11) permits authenticated backend operators to enumerate Joomla user profiles beyond their intended permission scope. An operator account granted access exclusively to the `com_icagenda` component - a tightly restricted, low-trust role - can leverage the flaw to query the broader Joomla user database, violating the principle of least privilege. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.1 (Medium) reflects the high privilege prerequisite and limited confidentiality impact.
Arbitrary PHP file upload in the iCagenda extension for Joomla enables remote unauthenticated attackers to abuse the event attachment feature to upload and execute server-side code, leading to full web application compromise. The flaw affects iCagenda 1.0.0-3.9.14 and 4.0.0-4.0.7 and carries a CVSS 4.0 score of 10.0 with exploitation marked as Attacked (E:A) in the vector, though no public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.
Stored cross-site scripting in iCagenda Joomla extension versions 4.0.8 through 4.0.12 allows an authenticated event submitter to inject persistent JavaScript payloads via the `image` and `file` fields of the frontend 'Submit an Event' form. The injected script executes in any viewer's browser upon rendering the affected event page, with highest consequence when a Joomla administrator previews or approves the submission, enabling session hijacking and full backend compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the stored nature of this XSS elevates risk above reflected variants due to its persistence and elevated-privilege victim profile.
Cross-site request forgery in the iCagenda Joomla extension (versions prior to 4.0.11) exposes multiple frontend state-changing operations - including event registration actions - to forged HTTP requests, because no CSRF token validation is applied to those endpoints. Any Joomla site running a vulnerable iCagenda release allows an attacker to trigger registrations or other frontend mutations on behalf of an authenticated visitor who is socially engineered into loading a crafted page. No public exploit has been identified at time of analysis, and the vendor has addressed the issue in version 4.0.11.
Access control bypass in the iCagenda Event Scheduler Extension for Joomla (all versions prior to 4.0.11) permits authenticated backend operators to enumerate Joomla user profiles beyond their intended permission scope. An operator account granted access exclusively to the `com_icagenda` component - a tightly restricted, low-trust role - can leverage the flaw to query the broader Joomla user database, violating the principle of least privilege. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.1 (Medium) reflects the high privilege prerequisite and limited confidentiality impact.
Arbitrary PHP file upload in the iCagenda extension for Joomla enables remote unauthenticated attackers to abuse the event attachment feature to upload and execute server-side code, leading to full web application compromise. The flaw affects iCagenda 1.0.0-3.9.14 and 4.0.0-4.0.7 and carries a CVSS 4.0 score of 10.0 with exploitation marked as Attacked (E:A) in the vector, though no public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.