EUVD-2026-47916
GHSA-h56c-539v-hqr6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (Joomla) · only source for this CVE.
CVSS VectorVendor: Joomla
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
MaxMind credentials where leaked in request URLs, causing a credential leakage vulnerability.
AnalysisAI
Information disclosure in the GeoIP extension for Joomla 1.0.0 through 6.3.8 exposes MaxMind API credentials directly in request URLs. Unauthenticated remote attackers can intercept these credentials from network traffic or server logs, gaining unauthorized access to the victim’s MaxMind geolocation service. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Geoip Extension For Joomla
View allUnsafe file extraction in the Joomla GeoIP extension (versions 1.0.0-6.3.8) enables remote code execution by writing fil
Unauthorized database updates can be triggered via CSRF in the GeoIP extension for Joomla, affecting versions 1.0.0 thro
We need to produce a JSON object with all fields as plain-text strings. Input: CVE-2026-63265. Description: Privileged R
GeoIP rule bypass in Joomla Geo
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today