Live › vulnerability › CVE-2026-102799
Go to dashboardThe registrations CSV export in iCagenda, a Joomla event extension, does not neutralize spreadsheet formulas in user-supplied fields. When an administrator opens the exported file in a spreadsheet program, injected formulas can run and may leak data or trigger actions on the admin's machine.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 12:32 UTC. All times on this page are UTC.
Joomla sites running iCagenda from 3.5.0 through 4.0.16 that collect registrations through public forms. The risk lands on administrators who export the registrations list and open it in a spreadsheet. Sites without iCagenda, or on a fixed version, can skip it.
No product ranges from the sources yet.
4.0.16, per the vendor's release notes (fixed version unknown from sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16
This page as .md · .json · in your agent: get_signal("CVE-2026-102799")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.