Jmedia Extension For Joomla
Monthly
Stored and reflected cross-site scripting in ThemeXpert's JMedia media-manager extension for Joomla lets an attacker upload a malicious SVG file that, because it is served without an X-Content-Type-Options: nosniff header, is interpreted and executed as active script in the context of the site. There is no public exploit identified at time of analysis and the flaw is not on CISA KEV, but the attack is well-understood and trivially reproducible. The supplied CVSS 4.0 base score of 9.4 appears inflated for a script-injection issue, so treat the raw number with caution.
Authenticated arbitrary file upload in the ThemeXpert JMedia media-manager extension for Joomla lets an authenticated privileged user (PR:H) write executable files to the server and achieve remote code execution. Uploads accept executable content and polyglot filenames, and the extension's chmod handling fails to strip execute bits, so a planted file can be directly invoked by the web server. Rated CVSS 4.0 9.4 (Critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Server-Side Request Forgery in the JMedia Extension for Joomla (themexpert.com) allows authenticated administrators to direct the extension's remote-URL download feature to issue server-side HTTP requests to internal or reserved IP address ranges, effectively using the Joomla host as a network proxy. With high privilege required (PR:H per CVSS 4.0 vector) and no direct impact on the vulnerable system itself (VC/VI/VA all N), real-world risk is primarily limited to internal network reconnaissance and interaction with co-located services. No public exploit code and no CISA KEV listing exist at time of analysis.
Stored and reflected cross-site scripting in ThemeXpert's JMedia media-manager extension for Joomla lets an attacker upload a malicious SVG file that, because it is served without an X-Content-Type-Options: nosniff header, is interpreted and executed as active script in the context of the site. There is no public exploit identified at time of analysis and the flaw is not on CISA KEV, but the attack is well-understood and trivially reproducible. The supplied CVSS 4.0 base score of 9.4 appears inflated for a script-injection issue, so treat the raw number with caution.
Authenticated arbitrary file upload in the ThemeXpert JMedia media-manager extension for Joomla lets an authenticated privileged user (PR:H) write executable files to the server and achieve remote code execution. Uploads accept executable content and polyglot filenames, and the extension's chmod handling fails to strip execute bits, so a planted file can be directly invoked by the web server. Rated CVSS 4.0 9.4 (Critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Server-Side Request Forgery in the JMedia Extension for Joomla (themexpert.com) allows authenticated administrators to direct the extension's remote-URL download feature to issue server-side HTTP requests to internal or reserved IP address ranges, effectively using the Joomla host as a network proxy. With high privilege required (PR:H per CVSS 4.0 vector) and no direct impact on the vulnerable system itself (VC/VI/VA all N), real-world risk is primarily limited to internal network reconnaissance and interaction with co-located services. No public exploit code and no CISA KEV listing exist at time of analysis.