Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the `image` and `file` fields as raw strings with no output-side HTML-attribute escaping.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-20 | 2 | Disclosure1General1 |
| 2026-09-12 | 1 | General1 |
CVE-2026-75948: How an Incident Response Put Me Inside iCagenda🥹 https://lulztigre.pw/posts/icagenda-stored-xss-75948.html
Post summary
The post references CVE‑2026‑75948 as a stored XSS flaw in iCagenda but provides no proof of concept, exploitation details, or patch information.
⚠️ Vulnerabilidades en productos Joomla ❗ CVE-2026-76564 ❗ CVE-2026-75948 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-joomla-4/ https://t.co/wBnl5FmOcd
Post summary
The message lists two Joomla CVE identifiers and points to an external link for more information, without providing technical, exploit, or mitigation details.
CVE-2026-75948 Joomla Extension - https://icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the `image` and `file` fields as … https://www.cve.org/CVERecord?id=CVE-2026-75948
Post summary
The post announces CVE‑2026‑75948, an authenticated stored XSS in iCagenda 4.0.8‑4.0.12, outlining the vulnerable fields but offering no PoC, exploit code, or patch information.