CVE-2026-102790

{
  "etk_id": "ETK-2026-2864",
  "cve_id": "CVE-2026-102790",
  "display_id": "CVE-2026-102790",
  "ghsa_id": "GHSA-pfmp-23x9-8m76",
  "euvd_id": "EUVD-2026-112028",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in iCagenda for Joomla",
  "summary": "iCagenda for Joomla versions 3.2.1 through 4.0.16 are affected by stored script injection in URL-type event custom fields. An attacker able to create or modify those event fields could cause script content to be retained and later run in another user's browser when the affected content is viewed.",
  "mitigation": "Restrict who can create or edit event custom fields, and review existing URL-type field values for untrusted content. Apply a vendor update when a fixed release is identified.",
  "vendor": "icagenda.com",
  "product": "iCagenda extension for Joomla",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "3.2.1-4.0.16"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "iCagenda extension for Joomla",
      "purl": null
    }
  ],
  "cwes": [
    79
  ],
  "cvss_score": 8.6,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 25.342369616666666,
  "t0_at": "2026-10-28T11:56:12.050000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-28T11:56:12.050000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T11:56:12.050000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102790"
    }
  }
}