DJ-Classifieds CVE-2026-105604

Exploitation requires that the DJ-Classifieds extension (version < 3.11.3) be installed and that its frontend search functionality be publicly reachable - which is the default for a classifieds/listings component intended for anonymous site visitors. No authentication, user interaction, or special configuration is indicated (PR:N/UI:N), so default public-facing deployments are exploitable by remote unauthenticated attackers. The primary limiting factor is product-specific: only sites running this particular Joomla extension below 3.11.3 are affected; the exact vulnerable search parameter and query context are not described in the available vendor reference.

This is a genuine high-priority issue, not a CVSS-inflated paper risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no authentication and no user interaction, reached through the public frontend search of an e-commerce/classifieds component - meaning the attack surface is exposed to anonymous internet visitors by design. The vuln.today Decision label is act_now, aligning with the 9.3 base score and the CWE-89 SQL injection class, which typically yields direct database read and, depending on the injection context, write/manipulation (reflected in VC:H/VI:H/VA:H). Conflicting/missing signals must be noted: no EPSS exploitation-probability score was provided, the vulnerability is NOT listed in CISA KEV in the supplied data, and no POC/exploit reference was provided - so there is no evidence of active or public exploitation despite the high severity. The elevated priority therefore rests on exploitability characteristics (unauthenticated, network, trivial complexity) rather than on confirmed in-the-wild activity. The only reference is the vendor landing page (dj-extensions.com), not a detailed advisory, so mechanism-level details beyond 'frontend search' are unverified.

An anonymous attacker browses to a public DJ-Classifieds listing on a Joomla site and submits a crafted value through the frontend search parameter, injecting SQL into the backend query. Because no login is required (PR:N) and complexity is low, the attacker extracts database contents such as user records and session/credential data, and may alter stored data. No public exploit code was provided in the input, so weaponization status is unknown.