CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
What the vulnerability does
Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the `image` and `file` fields as raw strings with no output-side HTML-attribute escaping.
Explanation of Vulnerability in Simple Terms
The iCagenda extension for Joomla contains a cross-site scripting (XSS) vulnerability in versions 4.0.8 through 4.0.12. An authenticated user with low privileges can inject malicious scripts that execute in other users' browsers when they view affected pages. The vulnerability requires user interaction—the victim must visit a page containing the injected payload. This can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.
What an attacker can do
Inject and execute malicious JavaScript in other users' browsers to steal sessions, credentials, or perform actions as the victim.
Potential impact on your site
Authenticated users' accounts and data are at risk; site visitors may be redirected, have credentials stolen, or have unauthorized actions performed on their behalf.
Conditions required to exploit
Attacker must have low-level Joomla user account; victim must visit a page containing the malicious payload.
Key dates
External resources
Related vulnerabilities
