{"id":"CVE-2026-102799","aliases":[],"cve":{"records":[{"id":"CVE-2026-102799","source":"Joomla","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-29T17:08:03.369Z","published":"2026-10-28T11:53:05.596Z","modified":"2026-11-11T04:41:03.494Z"}],"publishers":[{"name":"Joomla","role":"CNA","organizationId":"6ff30186-7fb7-4ad9-be33-533e7b05e586","modified":"2026-11-11T04:41:03.494Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-06T18:37:20.619Z"}],"references":[{"url":"https://www.icagenda.com/","tags":["product"],"source":"Joomla"}],"weaknesses":[{"id":"CWE-1236","description":"CWE-1236 Improper Neutralization of Formula Elements in a CSV File","source":"Joomla"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-06T18:15:03.696490Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16","titleSource":"Joomla","descriptionSource":"Joomla","description":"Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16","score":5.3,"severity":"medium","published":"2026-10-28T11:53:05.596Z","modified":"2026-11-11T04:41:03.494Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"icagenda.com","name":"iCagenda extension for Joomla","platforms":[],"versions":[{"version":"3.5.0-4.0.16","status":"affected"}],"defaultStatus":"unaffected","cpes":[],"source":"Joomla","url":"https://www.cve.org/CVERecord?id=CVE-2026-102799"}],"remediation":[],"references":["https://www.icagenda.com/"],"sources":[{"name":"CVE","id":"CVE-2026-102799","modified":"2026-11-11T04:41:03.494Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-102799"}],"assessments":[{"source":"Joomla","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L","score":5.3}],"sourceAffected":[],"observedAt":"2026-11-11T07:33:52.927Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:55:32.844Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-28T13:25:34.813Z","attemptedAt":"2026-10-28T13:25:34.813Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-28T13:25:35.537Z","attemptedAt":"2026-10-28T13:25:35.537Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-28T13:25:35.267Z","attemptedAt":"2026-10-28T13:25:35.267Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-28T13:25:34.986Z","attemptedAt":"2026-10-28T13:25:34.986Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-102799","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102799","modified":"2026-10-28T12:17:39.650","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-10-28T13:25:34.813Z"},{"source":"ENISA EUVD","id":"EUVD-2026-112025","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112025","modified":"Oct 28, 2026, 12:31:08 PM","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L","checkedAt":"2026-10-28T13:25:35.267Z"},{"source":"GitHub Advisory Database","id":"GHSA-8ww4-2p6w-9hcc","url":"https://github.com/advisories/GHSA-8ww4-2p6w-9hcc","modified":"2026-10-28T12:31:16Z","checkedAt":"2026-10-28T13:25:35.537Z"}],"aiSummary":{"text":"The iCagenda extension for Joomla has a CSV formula injection weakness in versions 3.5.0 to 4.0.16, potentially affecting the registrations export. An attacker with access to the export feature may exploit this. The impact is not fully stated.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:55:29.659Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-102799"}]}}