EUVD-2026-47909
GHSA-x4c7-x467-xc9c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Primary rating from Vendor (Joomla) · only source for this CVE.
CVSS VectorVendor: Joomla
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Lifecycle Timeline
3DescriptionCVE.org
GeoIP lookups trusted spoofable forwarded client-IP headers, this could cause GeoIP-rule bypass.
AnalysisAI
GeoIP rule bypass in Joomla Geo
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Geoip Extension For Joomla
View allUnsafe file extraction in the Joomla GeoIP extension (versions 1.0.0-6.3.8) enables remote code execution by writing fil
Unauthorized database updates can be triggered via CSRF in the GeoIP extension for Joomla, affecting versions 1.0.0 thro
We need to produce a JSON object with all fields as plain-text strings. Input: CVE-2026-63265. Description: Privileged R
Information disclosure in the GeoIP extension for Joomla 1.0.0 through 6.3.8 exposes MaxMind API credentials directly in
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today