EUVD-2026-62492
GHSA-5hvc-jq76-66vg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, no privileges or interaction required per CVSS 4.0 baseline; unchanged scope with limited per-record confidentiality and integrity impact only.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference (multiple frontend/API actions) in J-BusinessDirectory < 6.2.3
AnalysisAI
Insecure Direct Object Reference (IDOR) in J-BusinessDirectory versions below 6.2.3 allows unauthenticated remote attackers to access and modify business directory records belonging to other users across multiple frontend and API endpoints. The CVSS 4.0 vector (PR:N, AV:N, AC:L) confirms no authentication is required, meaning any internet-connected user can exploit the flaw against a default installation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - the CVSS 4.0 vector (PR:N/UI:N/AV:N/AC:L) confirms unauthenticated remote exploitation against any default installation of J-BusinessDirectory prior to version 6.2.3. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.9 (Medium) reflects a realistic threat profile: network-reachable (AV:N), no complexity barrier (AC:L), no privileges required (PR:N), and no user interaction (UI:N), with limited confidentiality and integrity impact (VC:L/VI:L) and no availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a Joomla site running J-BusinessDirectory by inspecting page source or response headers. The attacker then sends crafted HTTP requests to vulnerable frontend or API endpoints, substituting their own object ID with sequentially incremented or guessed IDs belonging to other users' business listings, modifying or reading records they do not own. … |
| Remediation | Upgrade J-BusinessDirectory to version 6.2.3 or later, which resolves the IDOR conditions across the affected frontend and API endpoints. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary file upload and deletion in the J-BusinessDirectory extension for Joomla (versions before 6.2.3) lets remote a
SQL injection in the J-BusinessDirectory extension for Joomla (by cmsjunkie.com) before version 6.2.3 lets remote attack
Denial-of-service in the J-BusinessDirectory Joomla extension (all versions before 6.2.3) allows unauthenticated remote
Open mail relay in the J-BusinessDirectory Joomla extension (versions 1.0.0-6.2.2) allows unauthenticated remote attacke
Unauthenticated listing ownership takeover in J-BusinessDirectory (a Joomla extension by cmsjunkie.com) prior to version
Reflected XSS and XML injection in the J-BusinessDirectory Joomla extension (cmsjunkie.com, versions prior to 6.2.3) exp
Cross-site request forgery (CSRF) in the J-BusinessDirectory Joomla extension (versions prior to 6.2.3 by cmsjunkie.com)
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today