Back to the CVE list
CVE-2026-48939 CISA KEV · Actively exploitedSuited to automated attack · CISA

Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15

CVSS score

10.0

EPSS probability

%20.1

Risk score

4.0

Published

4 mo ago

OverviewPublic Exploits (4)NewsroomVulnerability Timeline

Public Exploits · GitHub and Metasploit Intelligence

This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.

G
Polosss/By-Poloss..-..CVE-2026-48939
GitHub

iCagenda Unauthenticated File Upload to RCE (★0)

Public PoCSource updated: 29.06.2026 20:11:43
G
shinthink/CVE-2026-48939
GitHub

Pre-auth arbitrary file upload RCE exploit for iCagenda Joomla extension < 4.0.8 (CVSS 10.0) (★0)

Public PoCSource updated: 06.07.2026 09:18:05
G
ChiefYoru/CVE-2026-48939_PoC
GitHub

iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution. (★0)

Public PoCSource updated: 19.07.2026 07:03:20
N
projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48939.yaml
Nuclei

Nuclei: Joomla iCagenda < 3.9.10 - Unauthenticated Arbitrary File Upload RCE

Exploit reference

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-48939"