Joomla
Monthly
Cross-site request forgery (CSRF) in the Gridbox extension for Joomla before 2.20.4.0 allows unauthenticated attackers to install arbitrary language packs by tricking a logged-in administrator (or any user with the core.tools permission) into visiting a crafted URL. The PagesController's addLanguage action fails to enforce the POST method, bypassing Joomla's session-token validation, which is only applied to POST requests. No public exploit code was identified at time of analysis; exploitation requires user interaction (the victim must be authenticated with core.tools).
Unauthenticated SQL injection in the OrdaSoft Simple Membership extension for Joomla (versions before 7.4.0) allows any remote attacker to read and manipulate the site's backend database through crafted input to the checkLoginPass task. The site/simplemembership.php endpoint dispatches task=checkLoginPass with no authentication or access-control check and concatenates the login request parameter straight into a SQL query with no escaping or parameterization, which scores 9.3 under CVSS 4.0 with PR:N and no user interaction required. Exploitation needs only that the component be installed and enabled on a publicly reachable Joomla site - no credentials, user interaction, or non-default setting - and no public exploit identified at time of analysis.
Unauthenticated remote attackers can download any customer's purchased digital goods from Joomla sites running the Phoca Cart extension (versions 5.0.0 through 6.1.8), because the order-file download endpoint checks only that the 'd' (download token) and 'o' (order token) parameters are non-empty instead of comparing them with the stored download_token and order_token values. Any guest with no account can enumerate sequential numeric order IDs, supply arbitrary non-empty token values, and retrieve files belonging to other customers, making this a high-severity confidentiality breach with no authentication and no user interaction required (CVSS 4.0 base 8.7; assessed CVSS 3.1 7.5, C:H/I:N/A:N). No public exploit code was identified at time of analysis, and the issue is a genuine high-priority concern rather than an inflated score, with impact limited only by the practical prerequisite that the store actually offers downloadable goods served through this endpoint and has existing order records to enumerate.
Unauthenticated SQL injection in OrdaSoft Joomla CCK before 8.3.16 allows remote attackers to execute arbitrary SQL via the user-supplied order column for records, compromising the confidentiality, integrity, and availability of the Joomla database. The flaw affects only sites that have installed this third-party CCK extension, so prevalence is the main limiting factor; no public exploit code was identified at time of analysis, and there is no KEV confirmation of active exploitation. With a CVSS 4.0 score of 9.3 and an independent CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:N/C:H/I:H/A:H, this is a high-priority issue for affected deployments.
Unauthenticated remote code execution in OrdaSoft Joomla CCK (all versions below 8.3.16) lets any remote attacker who can reach the component's frontend upload and execute arbitrary PHP, resulting in full compromise of the Joomla site - the CVSS 4.0 base score is 10.0 and the independent CVSS 3.1 assessment is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The upload endpoint site/uploader.php is reachable through the component's normal frontend routing via task=getContent with no authentication or ACL check anywhere in the dispatch chain, and the shipped source has its file-extension allow-list commented out, so an image/PHP polyglot carrying an attacker-chosen .php extension passes the magic-byte MIME check and is written to an executable path under the Joomla web root. Exploitation requires no privileges, no user interaction, and no non-default configuration - only that the extension be installed and its frontend be web-reachable; the supplied CVSS v4.0 vector carries E:A (Exploit Maturity: Attacked), although no CISA KEV entry was supplied in the available intelligence, so that metric is the sole exploitation signal available here.
Unauthenticated SQL injection in the JCTables extension for Joomla (joomcode.com) through version 1.21.1 lets any remote attacker read and write arbitrary database content, because the extension's front-end CRUD API controller performs neither a Joomla token check nor any authentication check on any task. Table names, column names and values are taken directly from request parameters and concatenated into SQL, so a default install with the extension's front-end endpoint reachable is exploitable by an unauthenticated attacker with no user interaction and no non-default configuration (CVSS 4.0 base 10.0; our independent assessment concurs this is a top-tier priority rather than a high-score/low-risk case). Exposure is limited to Joomla sites that actually have this specific third-party extension installed, and no confirmed public exploit code was identified in the available intelligence at time of analysis, although public research describing a read/write SQLi-to-RCE chain has been published.
Unauthenticated remote code execution in the Balbooa Forms extension for Joomla (versions before 2.4.3.4) lets a visitor submit a crafted public form that results in attacker-controlled PHP being evaluated server-side. The root cause is that the extension substitutes form-field shortcodes with the raw value submitted by the visitor before passing administrator-defined 'PHP after submission' code to eval(), allowing a value to break out of a double-quoted PHP string. Exploitation is conditional, not blanket: it requires an administrator to have enabled the optional PHP-after-submission action and to have interpolated an attacker-controllable field shortcode inside a double-quoted string, a non-default configuration reflected as AT:P. No public exploit code or confirmed active exploitation was identified at time of analysis, and no CPE string was supplied; the vendor scores this 9.5 (critical) whereas our independent CVSS 3.1 assessment is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Unauthenticated path traversal in Balbooa Forms (a Joomla extension) before 2.4.3.4 allows remote attackers to exfiltrate local files readable by the Joomla process via crafted upload-field JSON during public form submission. The flaw requires that the target form has both the 'auto reply' and 'attach uploaded files' options enabled, limiting exploitability but still posing high risk given the CVSS 4.0 score of 8.9 and no authentication or user interaction required. No public exploit code has been identified at time of analysis, and no active exploitation has been confirmed via CISA KEV.
Stored cross-site scripting in the Balbooa Forms extension for Joomla (all versions before 2.4.3.4) allows an unauthenticated attacker to embed script code in the original multipart filename of a file uploaded through any public-facing form that offers an upload field. The filename is saved verbatim to the component's attachments table and, when a Joomla administrator later opens the attacker's submission in the backend, the component's JavaScript concatenates that stored filename into an HTML string assigned to innerHTML, executing the script in the administrator's session; there is no public exploit identified at time of analysis, and while the vendor scores this CVSS 4.0 8.6, our independent assessment rates it CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N because the payload only fires on privileged human interaction and has limited confidentiality and integrity impact.
Unauthenticated SQL injection in the OrdaSoft Book Library (Free) extension for Joomla, affecting all versions below 6.4.6, allows remote attackers to inject arbitrary SQL into an ORDER BY clause via the field and direction request parameters handled by the books() function in site/booklibrary.php. Because the injection lands in an unquoted ORDER BY position, the extension's keyword-blacklist filter (protectInjectionWithoutQuote()) can be defeated with a trailing decoy comment such as '-- xselect' that makes the filter merely quote the value instead of rejecting it, and exploitation requires only a prior request to prime session-stored sort defaults before the vulnerable code path is reached. Both the vendor's CVSS 4.0 vector (9.3, AV:N/AC:L/AT:N/PR:N/UI:N, high C/I/A) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicate a fully unauthenticated, low-complexity, network-reachable flaw with high confidentiality, integrity, and availability impact; no public exploit code and no CISA KEV entry were identified at time of analysis.
Unauthenticated SQL injection in the OrdaSoft Real Estate Manager (Free) extension for Joomla before 6.7.9 allows remote attackers to inject arbitrary SQL through the order_field parameter, which is concatenated unquoted into the ORDER BY clause of three public frontend property-listing queries (category browsing, search results, and full listing). Because the injection point is exposed on pre-authentication pages with no login, user interaction, or non-default configuration required, any reachable installation is at risk; the assessed impact is high confidentiality loss (blind extraction of database contents), while the ORDER BY sink constrains the attacker to data-read techniques rather than direct modification. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the only reference supplied is the vendor site, so patch status should be verified directly with OrdaSoft.
Unauthenticated SQL injection in the Vehicle Manager (Free) extension for Joomla versions prior to 6.5.8 allows remote attackers to inject SQL code via the order_field and order_direction parameters at three frontend entry points (category listing, search, and all-vehicles listing). Because the injection point is an unquoted ORDER BY clause, exploitation is constrained to blind/inferential techniques, but it can still lead to high confidentiality impact (e.g., extraction of sensitive database contents) with limited integrity and availability impact. No public exploit code has been identified, and the vulnerability requires no authentication or non-default configuration, making any public-facing installation a potential target; however, the overall real-world priority is moderate due to the product's footprint.
Stored cross-site scripting in Regular Labs Tabs & Accordions Pro versions 2.3.0 through 3.1.0 lets an authenticated Joomla user who can author or edit articles plant a JavaScript-executing browser URL scheme in a tab/accordion item's url option; the extension writes that value into a generated data-rlta-url attribute and the browser code later passes it to window.open() when the item is activated. Because the payload is stored as ordinary plugin syntax at save time, Joomla's article filtering does not catch it, and the executable behavior only materializes at render/interaction time. The vendor vector (CVSS 4.0 7.5, AV:N/AC:L/AT:P/PR:H/UI:N) and our independent assessment (CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) agree that exploitation requires privileged, authenticated content-authoring access and a victim who actively activates the affected item, so this is a genuinely moderate, not high, real-world risk; no public exploit code has been identified at time of analysis.
Server-side request forgery and local file inclusion in Regular Labs Modules Anywhere for Joomla (Pro versions 1.5.0 through 9.0.5) allow an attacker with content-authoring privileges to override module parameters and cause the server to open attacker-influenced URLs or local files. The parameter-override feature is enabled by default and applies attributes without verifying who authored the content containing the module tag; Joomla's core Feed module with its rssurl parameter is a confirmed vector. The vendor rates this 8.5 under CVSS 4.0, but the independent assessment (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) indicates high technical impact with moderate real-world priority because authentication is required and exposure depends on the selected module; no public exploit was identified at time of analysis.
Authenticated directory deletion in the Event Gallery extension for Joomla (svenbluege.de) below version 6.5.0 allows a high-privileged Joomla backend user to supply a traversal payload in the `images` parameter of the `cache.process` clear-cache task and recursively delete any directory the web server account is permitted to write to. The impact is confined to integrity and availability of web-server-writable paths - there is no confidentiality loss (VC:N/SC:N) and no privilege gain beyond the actor's existing administrator-level access, which is the main limiting factor (PR:H), giving a CVSS 4.0 base score of 7.0. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the root cause is a CWE-22 path traversal that accepts unsanitised relative paths before file deletion.
Unauthenticated path traversal in the lomart.fr UP extension for Joomla (versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29) allows remote attackers to read files outside the intended plugin directory, exposing configuration files, credentials and other sensitive data under the web root's readable filesystem. The reported CVSS 4.0 score is 9.2, and the independently assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms a confidentiality-only impact with no authentication or user interaction required, while integrity and availability remain unaffected. Real-world risk is governed by deployment scope rather than exploitability: this is a niche third-party Joomla extension, no public exploit was identified at time of analysis, and only sites that have the plugin installed and enabled at an affected version are exposed.
Unauthenticated remote code installation in the lomart.fr 'UP' plugin for Joomla (versions 5.0.0-5.2.0 and 6.0.0-6.0.29) allows remote attackers to write and install arbitrary code on affected sites without authentication, user interaction, or non-default configuration, as reflected in the vendor's CVSS 4.0 base score of 10.0. The flaw is a path traversal (CWE-22) that lets attacker-supplied paths escape the intended directory and place executable content where the web server will run it, giving full compromise of confidentiality, integrity, and availability on the host and follow-on systems. This is a niche, single-vendor Joomla add-on, so exposure depends entirely on whether the plugin is installed and active; no public exploit has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing).
Unauthenticated SQL injection exists in the lomart.fr UP Plugin for Joomla at versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29, letting remote attackers reach the plugin's vulnerable request handlers and inject arbitrary SQL into backend database queries; the vendor-assigned CVSS 4.0 vector (8.3, AV:N/AC:L/AT:P/PR:N/UI:N) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) both describe a network-reachable, no-authentication, no-user-interaction flaw capable of returning or altering stored data. Only Joomla sites that actually have this third-party extension installed and expose the affected endpoint are in scope, and the plugin's comparatively small install base limits the overall attack surface; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV). Successful exploitation depends on the injectable feature being reachable in the target deployment, which is why the CVSS 4.0 vector carries the AT:P attack-requirement flag.
Authenticated PHP code injection in the lomart.fr UP Plugin for Joomla (versions 5.0.0-5.2.0 and 6.0.0-6.0.29) allows a high-privilege administrator to execute arbitrary PHP code and system commands on the underlying server. The flaw requires a valid Joomla administrator account (PR:H) and is remotely exploitable without user interaction, but no public exploit code or active exploitation has been identified at time of analysis. Because the plugin is a narrowly deployed third-party extension and no vendor patch is available, the real-world priority is low despite the critical CVSS score (9.4), with mitigation limited to removing the plugin or tightly restricting administrative access.
Unauthenticated arbitrary file deletion in the AcyMailing Enterprise extension for Joomla (versions before 11.1.0) allows a remote attacker to store an arbitrary filesystem path - including paths that traverse outside the configured upload directory, such as configuration.php - in a file-type custom field and have the extension delete that file when the field is subsequently cleared. Exploitation requires a publicly reachable subscription or profile form that has a file-type custom field configured, so a default installation without such a field is not affected; the CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H) confirms network reachability, low complexity, no privileges required and no user interaction, with high integrity and availability impact but no confidentiality impact, reflecting a purely destructive outcome rather than data theft. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor has released a fixed version.
Unauthenticated remote code execution in AcyMailing Enterprise for Joomla (versions before 11.1.0) lets anyone who can email the address monitored by the extension's 'mailbox action' feature write a PHP file into the site's web root, because inbound MIME parts are stored under media/com_acym/upload/ with no extension check (CWE-434); once reachable over HTTP and PHP-executable, that file runs as the web-server account. The gating precondition is that mailbox monitoring is enabled and the upload path is web-exposed, which is not a default configuration, but where it applies exploitation is trivial and requires no authentication (CVSS 4.0 9.5 with AT:P; independent assessment CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, with the scope change reflecting impact escaping the extension into the hosting Joomla site). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the vendor-released fix is AcyMailing Enterprise 11.1.0.
Unauthenticated SQL injection in the joomlaboat.com YouTube Gallery extension for Joomla (versions below 5.7.3) lets remote attackers inject arbitrary SQL into read queries through the video search and sorting parameters of the public-facing gallery. No credentials, user interaction, or non-default configuration are required - only that the extension is installed and its video search/sorting front end is reachable, which is its normal deployment state. The CNA rates it 9.3 under CVSS 4.0, our independent assessment scores it as high severity with confidentiality impact dominant (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L), and no public exploit code or confirmed active exploitation was identified at time of analysis. Impact is bounded by deployment scope: core Joomla installations without this third-party extension are not affected, but any site that does run it is exposed to unauthenticated database disclosure.
EasyStore for Joomla versions 1.0.0 through 3.0.0 does not enforce CSRF token verification across most administrator AJAX endpoints, enabling an attacker to trick a logged-in Joomla administrator into changing store data such as orders, coupons, media, customers, settings, tags, categories, reviews, and collections. Only the products() action checked tokens; the vendor fix moves verification into ApiController::execute() and applies Session::checkToken() to POST, PUT, PATCH, and DELETE requests. No public exploit code was identified at time of analysis, and exploitation requires an active admin session plus user interaction, so this is a moderate-risk CSRF issue despite the potential for high integrity and availability impact.
PII harvesting in JoomShaper EasyStore 1.0.0-3.0.0 allows unauthenticated attackers to enumerate guest checkout records via the checkout.searchGuestUser endpoint, which returns full shipping details (name, phone, address) for any supplied email address. Despite vendor labeling as an authenticated SQL injection, the endpoint requires no authentication or session validation and enables bulk collection of customer PII. No public exploit code has been identified at time of analysis; the vendor has resolved the issue by removing the server-side endpoint and migrating autofill to client-side localStorage.
Authenticated SQL injection in the Easy Store extension for Joomla (versions 1.0.0 through 3.0.0) allows a Joomla administrator to inject arbitrary SQL through the coupon bulk update task at administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdate. The flaw is a genuine injection (reported as CWE-74, functionally classic CWE-89 SQLi) where coupon IDs are concatenated straight into raw SQL IN (...) clauses instead of being cast to integers or parameterized. Exploitation is confirmed to require high privilege (PR:H in the assessed CVSS:3.1 vector), and there is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is low at 0.25% (14th percentile), so despite the 8.6 headline score the practical priority is moderate-to-low because Joomla administrators already hold broad database-level trust.
Authenticated Joomla backend users of any privilege level can bypass EasyStore's ACL checks and edit arbitrary records in versions 1.0.0 through 3.0.0. The allowEdit() method in ApiController.php is hardcoded to return true, defeating Joomla's component- and asset-level permission model (CWE-284). The vendor rates this high severity (CVSS 8.6), though our independent assessment confirms the attack requires an existing backend account and is not exploitable by unauthenticated visitors; no public exploit identified at time of analysis.
Unauthenticated PII harvesting in the JoomShaper Easy Store extension for Joomla (versions 1.0.0 through 3.0.0) allows anyone to retrieve guest checkout records by submitting an email address to the checkout.searchGuestUser endpoint, which returns full name, phone number, street address, city, postal code and country directly from the #__easystore_guests table with no authentication, session validation or ownership check. Attackers can script the endpoint against purchased or scraped email lists to enumerate guest customers and compile sensitive personal data at scale, with no user interaction required. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but the attack is trivially reachable; yield depends on email-list quality and on whether a given site has actually used guest checkout, since only matching guest emails return data.
Remote code execution in the OrdaSoft Joomla Gallery extension (both the free and the commercial editions) before version 6.2.7 lets an authenticated Joomla backend user holding the core.manage permission upload a .php file into a web-accessible directory and execute it simply by requesting the resulting URL, giving full control of the Joomla host under the web server's account. The root cause is the extension's saveWatermark() routine, which stores the client-supplied filename exactly as sent with no extension check, no content check and no filename sanitisation, so a spoofed image Content-Type header is sufficient to smuggle a PHP payload through the upload path. Scoring is severe (vendor-assigned CVSS 9.4; our independent CVSS 3.1 assessment is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and although exploitation is gated on a privileged authenticated role rather than an anonymous visitor, no public exploit code has been identified at time of analysis.
Unauthenticated SQL injection in the OrdaSoft Joomla Gallery extension for Joomla (both the free and paid editions) below version 6.2.7 allows any anonymous visitor to inject SQL through the publicly published mod_osgallery_search search box and read arbitrary database content. The showSearchResult() and showSearchResultAjax() endpoints take the textsearch/searchText request parameter and concatenate it directly into a LIKE clause without quoting or escaping, and the CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) and the accompanying CVSS:3.1 assessment (PR:N/UI:N) both confirm the attack needs no authentication, no user interaction, and no special client configuration. Impact is scoped primarily to data disclosure - the authoritative assessment scores C:H/I:L/A:N because the injection point is a SELECT's LIKE clause - and no public exploit code was identified at time of analysis; exploitation is limited to sites running an affected Gallery version that actually publish the search module. This is a genuine high-priority vulnerability, so prioritise inventory of Joomla sites with the extension and the search module enabled, and upgrade to 6.2.7 or later.
Authenticated SQL injection in the OrdaSoft Joomla Gallery extension (both Free and commercial editions) for Joomla versions below 6.2.7 allows a user holding the delegated core.manage permission for the gallery component to execute arbitrary SQL against the site's database, including UNION-based extraction of #__users password hashes and full read/write access to stored data. Exploitation requires a valid Joomla account with that scoped gallery-management right - there is no unauthenticated path - so exposure is concentrated on sites that delegate gallery administration to non-fully-trusted users. No public exploit code or confirmed active exploitation was identified at the time of analysis, and no EPSS or KEV data was supplied; severity is assessed as high (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, vendor-published CVSS 8.6).
Authenticated remote code execution in OrdaSoft Joomla Gallery (both the free and commercial editions) for Joomla below version 6.2.7 lets anyone holding a privileged Joomla backend account execute arbitrary PHP functions on the underlying server. The extension's updateOSGallery() handler, invoked through task=update_osgallery, takes a JSON body and calls the supplied 'method' value as a live PHP function with the 'package' value as its only argument, with no is_callable() check or allow-list, so functions such as system, exec, shell_exec and passthru are directly reachable. Rated CVSS 9.4 (CVSS 4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H; independently assessed as CVSS 3.1 scope-changed with C:H/I:H/A:H); exploitation requires authentication with a high-privilege role, which is the main limiting factor - this is not reachable by anonymous internet users, and no public exploit code was identified at time of analysis.
Arbitrary file rename across the Joomla filesystem is possible in SP Page Builder (Free and Pro) versions 4.0.0 through 6.9.0 due to missing directory confinement in the media rename controller task. Authenticated administrators or users with media management permissions can pair any valid media identifier with an unrelated filesystem path, bypassing the boundary checks that protect other folder operations in the same controller. An attacker exploiting this flaw can rename files outside the intended media directory - including renaming configuration.php - effectively taking the entire Joomla site offline or disrupting its integrity. No public exploit or active exploitation has been identified at time of analysis.
Authenticated SQL injection in JoomShaper's SP Page Builder Joomla extension (versions 5.2.1-6.9.0) lets backend-privileged users perform time-based blind SQL injection against the full Joomla database, including credential hash and active session tables. The `plgContentSppagebuilder::onContentAfterSave()` content plugin method directly concatenates a POST-supplied array element into a raw SQL `WHERE` clause without quoting or integer casting, and Joomla's own ARRAY input filter provides no sanitization of element values. No public exploit code has been identified at time of analysis, and SSVC rates exploitation status as none.
Stored cross-site scripting in the Regular Labs Snippets extensions for Joomla (Free < 7.0.0, Pro < 11.0.0) allows a lower-privileged Joomla author to inject malicious script into Snippet content by passing an unsafe value through the extension's article tag variable substitution mechanism, specifically via the url option. Because the affected versions do not validate the article author's trust level before substituting their tag-supplied variables into security-sensitive positions defined by a trusted Snippet author, the injected payload executes in the browser of any higher-privileged user who views the rendered article. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Regular Labs' Conditional Content Pro extension for Joomla (versions before 8.0.0) lets an author with article-publishing rights embed inline PHP inside Condition Rules, which the extension hands to its Conditions evaluator without verifying who authored the content. Because Joomla's standard Author text filter preserves the rule syntax, publishing a crafted article executes the attacker's PHP as the web-server process. No public exploit has been identified at time of analysis, and the flaw requires an authenticated, privileged Joomla account.
Stored cross-site scripting in the Regular Labs Modals extension for Joomla (all versions before 17.0.0) allows high-privileged content authors to inject executable browser URL schemes - such as javascript: - into modal destination fields, which the extension passes unvalidated into both the generated anchor href and the iframe source path. When any site visitor subsequently renders the affected page, the stored payload executes as JavaScript in their browser without requiring the Pro JavaScript Events feature to be enabled. No public exploit has been identified at time of analysis; the vendor-released fix is version 17.0.0.
Stored XSS in regularlabs.com's Articles Anywhere Joomla extension (versions prior to 20.0.0) lets authenticated article authors inject arbitrary JavaScript via link event handler options (onclick, onmouseover) in plugin syntax tags. The injected payload bypasses Joomla's built-in Author content filter because Articles Anywhere renders the event handler attributes into live HTML after the CMS filter has already processed the content. No public exploit has been identified at time of analysis, but the filter-bypass is architectural and cannot be mitigated without patching.
Stored cross-site scripting in the Modals Pro extension for Joomla (regularlabs.com) versions prior to 17.0.0 allows an authenticated Author-level user to inject executable JavaScript via documented event handler options (on-open, on-closed) embedded in article content. The extension intentionally supports JavaScript lifecycle events for modal dialogs but fails to enforce access control distinguishing which roles may supply executable code versus static configuration parameters - enabling a lower-privileged author to weaponize a trusted-user feature. When a higher-privileged user views the crafted article, the modal fires the injected script in their browser context. No public exploit or CISA KEV listing exists at time of analysis.
Stored cross-site scripting in regularlabs.com's Tabs & Accordions (Free and Pro) extension for Joomla, versions prior to 3.1.0, allows a privileged authenticated attacker to inject and permanently persist arbitrary JavaScript into page output by supplying a crafted value in the rtla-alias configuration field. The extension's link-rewriting renderer embeds the alias directly into an HTML onclick attribute as a JavaScript string argument, applying neither JavaScript-string escaping nor HTML-attribute encoding, so a crafted alias breaks both quoting contexts and executes in every subsequent visitor's browser. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored XSS in SP Property (a Joomla real estate extension by joomshaper.com) before version 4.1.4 allows unauthenticated remote attackers to inject persistent JavaScript payloads into property listings and related content. Multiple template files across both frontend views and administrator list tables rendered user-supplied attributes and text values directly into HTML without contextual output escaping, enabling the stored payload to execute in the browser of any user who views the affected page - including Joomla administrators. No public exploit code has been identified and this vulnerability is not currently listed in CISA KEV, but the stored nature and admin-context execution make this a high-priority remediation target for any site running the affected extension.
Cross-site request forgery in SP Property (a Joomla real estate extension by joomshaper.com) before version 4.1.4 allows unauthenticated attackers to forge POST requests against two unprotected endpoints. The visitor property booking endpoint (properties.booking) and agent contact form endpoint (agents.sendmail) both processed POST submissions without validating Joomla's built-in session anti-CSRF tokens, enabling an attacker who tricks a site visitor into loading a malicious page to submit fraudulent bookings or send arbitrary contact messages on that visitor's behalf. No public exploit has been identified at time of analysis.
Unauthenticated SQL injection in JoomShaper's SP Property extension for Joomla (versions before 4.1.4) lets remote attackers inject SQL through the property search and map-filtering query builders. The zipcode, sorting, price_range_dropdown, and psize_range_dropdown parameters are concatenated directly into WHERE and ORDER BY clauses without quoting or type casting, enabling boolean- and time-based blind extraction of database contents. No public exploit has been identified and the flaw is not in CISA KEV, but the unauthenticated network-reachable vector makes it a high-priority patch.
Path traversal (Zip Slip) in Joomla 6.1.1's com_joomlaupdate component enables persistent remote code execution when a Super User is socially engineered into extracting a crafted ZIP archive via the administrator interface. The extract.php extraction routine failed to validate ZIP entry filenames for parent-directory sequences (`..`), absolute Unix paths, Windows drive letter paths, or UNC paths - allowing an attacker-supplied archive to write arbitrary PHP files outside the intended extraction root. No confirmed active exploitation (not in CISA KEV); an upstream patch is available via GitHub commit and PR, though a tagged patched release version has not been independently confirmed.
Arbitrary file upload in Joomla's Easy Discuss component allows authenticated attackers to bypass file validation by spoofing extensions, since the component relies solely on extension checks without verifying MIME types. An attacker with user privileges can upload malicious files to achieve remote code execution on affected systems. No patch is currently available.
An issue was discovered in Joomla!. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in Joomla!. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 94.5%.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 93.4%.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \". Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Joomla!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 92.9%.
SQL injection vulnerability in Joomla!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 69.1%.
SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.php in Joomla!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 72.2%.
SQL injection vulnerability in Joomla!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 91.6%.
Akeeba Restore (restore.php), as used in Joomla!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
administrator/components/com_media/helpers/media.php in the media manager in Joomla!. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 52.1%.
Path traversal in the Gridbox extension for Joomla (versions before 2.20.4.0) allows unauthenticated remote attackers to read image files outside the configured images root when a sibling directory sharing the root's name prefix exists. The flaw resides in the site UploaderHelper's prefix-only containment check used by the showImage action; a request-controlled path can resolve to a sibling directory such as 'images-backup' if that directory exists and contains a file with a Gridbox-permitted image extension. Exploitation is limited to image-type files and requires the presence of such a prefix-matching sibling directory; no public exploit code has been identified and CISA SSVC reports no exploitation activity, with independent assessment rating the risk Low.
Unauthenticated attackers can delete arbitrary slider images and replace the entire OrdaSoft Touch Slider database tables site-wide via the module's AJAX handler in versions below 5.4.6. The handler modOsTouchSliderHelper::getAjax() lacks any JFactory::getUser(), authorise(), or CSRF-token check, so exploitation requires no session or task parameter and works against default configurations where the module is installed and enabled. No public exploit identified at time of analysis.
Unauthenticated guests can force execution of any published automation task in TF Content for Joomla versions 2.9.0 through 2.9.4 by supplying a task's numeric ID to the records.custom_action endpoint. The extension lacks authentication, ACL, CSRF, task-trigger, content-binding, and cron-token enforcement, allowing immediate dispatch of the configured executor. No public exploit identified at time of analysis, and the risk is assessed as a genuine but mid-tier priority.
Server-side request forgery (SSRF) in Event Gallery for Joomla before 6.6.0 allows an attacker to make the server send the Google Photos OAuth access token to an arbitrary address or probe internal network resources. The vulnerability resides in the back-end upload page's Google Photos picker, which fetches image thumbnails using a user-supplied address without validation and without a form token, enabling exploitation via CSRF against a logged-in administrator or directly by a back-end user with 'Manage' permission. No public exploit code has been identified, and the risk is assessed as moderate and targeted.
Reflected cross-site scripting (XSS) in the Dynamic Content Filter addon of the SP Page Builder Pro extension for Joomla (versions 3.0.0 through 5.6.1p2) allows unauthenticated attackers to inject arbitrary HTML or JavaScript into a victim's browser by crafting a URL with a malicious dc_filter_<fieldId> parameter, provided the addon is used with a slider field. The flaw is rated medium severity (CVSS 4.0 base 5.3; independent assessment CVSS 3.1 base 5.3) and requires user interaction-the victim must load the crafted link. No public exploit code has been identified at time of analysis, and CISA KEV does not list active exploitation.
Reflected cross-site scripting and an open redirect in the front-end "share mini page" of the Joomla Event Gallery extension (svenbluege.de) affect all versions below 6.6.0. When the "Share article links" option is enabled, the article address carried in a crafted share link is rendered into the page without validation or output encoding, and when the link type is set to "Image Page with Redirect" the address is followed immediately, allowing an attacker to execute script in the browser session of any visitor who opens the prepared link or to silently redirect that visitor to an attacker-controlled site. The vulnerability is unauthenticated remote (CVSS 4.0 base 5.3; independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), requires a victim to click the malicious link, and no public exploit code has been identified at time of analysis; there is no server-side read or write, so impact is confined to the victim's browser session.
TF Content 2.9.0 through 2.9.4, a Joomla content extension distributed by joomlafry.com, allows unauthenticated remote attackers to create and modify arbitrary TF Content records because its public RecordController performs no authorization check and its shared frontend save controller writes the raw jform array without filtering it through the configured form. By pulling a valid Joomla token from the public login form and supplying an existing record ID, a guest - with no account, privileges, or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) - can mass-assign fields such as published, access, and created_by on any TF Content row. Impact is bounded to low confidentiality, integrity, and availability effects on TF Content data rather than full site compromise; no public exploit code or confirmed active exploitation was identified at time of analysis, placing this as a genuine but moderate-priority issue.
Cross-site request forgery in the Event Gallery extension for Joomla (all versions before 6.6.0) allows an attacker-controlled external page to silently flip back-end configuration flags - default payment method, shipping method, image type set, order status, watermark, putting an event in or out of the shop, selecting an event's main image, toggling the main-image-only flag, and sorting event images - in the name of an administrator. The eight affected back-end list buttons never validate the Joomla form token, so the forged requests execute with the privileges of a victim who has an active administrator session and visits the malicious page (user interaction required, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). Impact is deliberately narrow - no data can be read or deleted and orders are unaffected - so this is a medium/low-priority issue rather than a high-CVSS alarm; no public exploit code or confirmed active exploitation was identified at time of analysis, and the flaw is fixed in version 6.6.0.
Unauthenticated remote attackers can tamper with uploaded file metadata in Balbooa Forms for Joomla versions before 2.4.3.4 by exploiting insufficient validation of client-supplied filenames and display names during the final form submission. This allows cross-session file claiming and potential path traversal via the getFilePath() function, though the impact is limited to integrity with no confidentiality or availability loss. No public exploit code or active exploitation has been identified, and the CVSS 4.0 score of 6.9 overstates the real-world risk per independent assessment.
Unauthenticated guests can delete other users' temporary file attachments on Joomla sites running the Balbooa Forms extension below version 2.4.3.4. The public removeTmpAttachment action accepts an integer attachment ID and deletes the matching database row and file; the controller does verify a Joomla session token, but the model never ties that ID to the uploading session, user, form, upload field, or temporary state, so any guest can obtain a token for their own session and then destroy arbitrary pending uploads by enumerating valid integer IDs. Impact is confined to integrity of temporary/pending attachment records and files (CVSS 3.1 C:N/I:L/A:N, no confidentiality or availability effect), and no public exploit code has been identified at time of analysis.
Reflected cross-site scripting in the OrdaSoft Book Library (Free) extension for Joomla, affecting versions below 6.4.6, lets an unauthenticated remote attacker inject arbitrary HTML and JavaScript that executes in a victim's browser session. The flaw lives in the publicly reachable book-detail view (site/views/view_book/tmpl/default.php), where the 'title' request parameter is echoed raw inside a double-quoted HTML attribute, so a value containing a double quote breaks out of the attribute and everything after it is rendered as markup. Exploitation requires passive user interaction - the attacker must deliver a crafted link to a victim (UI:P) - and impact scales with the victim's privileges, so a lured logged-in administrator yields a far more serious outcome than an anonymous visitor; no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the first-party assessment rates this a genuine but modest-severity reflected XSS.
Reflected cross-site scripting in the ordasoft.com Real Estate Manager (Free) extension for Joomla before version 6.7.9 lets remote attackers execute arbitrary script in a victim's browser by luring them to a crafted URL. The flaw lives in the 'leave a review' form on the public property-detail page, where the review title is echoed from the request straight into a double-quoted HTML attribute with no escaping or filtering at all - a double-quote character in the title parameter breaks out of the attribute and permits a following <script> element to run. No authentication is required and the CVSS 4.0 base score is 5.3 (assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N); exploitation depends on the victim loading the malicious link, so it is not self-triggering, and no public exploit code was identified at time of analysis. Impact is contained to the tricked user's browser session, with no server-side compromise; this is a genuine but low-severity issue.
Stored cross-site scripting in TPVEnlanube enables an authenticated backend user to store malicious JavaScript in the 'Apellido 1' field of the Joomla/VirtueMart administrator user-add endpoint '/administrator/index.php?page=admin.user_add&user_id=45&option=com_virtuemart'; the payload executes in the browser of a privileged user or administrator who later views the affected user record. The flaw is not self-triggering and requires two actors-an authenticated low-privileged account to store the payload and an administrator to render it-so the assessed impact is low-to-moderate, limited to script execution in the victim's admin session, with no public exploit identified at time of analysis and no direct server-side code execution.
Stored cross-site scripting (XSS) in TPVEnlanube, a Joomla/VirtueMart payment gateway extension, allows an authenticated attacker to inject malicious script into the 'Nombre Completo' field, which then executes in the browser of any privileged user viewing the VirtueMart administrator user-list page (admin.user_list). The vulnerability affects all versions of the extension (CPE wildcard) and requires the victim to interact with the page. No public exploit has been identified, and the overall risk is assessed as low-to-moderate due to the need for authentication and user interaction, with impact limited to browser-based script execution rather than server compromise.
Stored cross-site scripting in TPVEnlanube allows an authenticated user with access to the VirtueMart store administration function to persist arbitrary script through the 'vendor_store_name' parameter at the '/administrator/index.php?pshop_mode=admin&page=store.store_add&option=com_virtuemart&vendor_id=[ID]' endpoint; the payload then executes in the browser of any administrator or user who later renders the poisoned store record. Exploitation is high-friction: it requires valid backend credentials (CVSS PR:L), reachability of the store-management feature, and a separate privileged victim who opens the affected record (UI:A), which caps the realistic impact at low-confidentiality/low-integrity for the victim's session. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; severity is low (CVSS 4.0 base 4.8).
Cross-site request forgery in the Event Gallery extension for Joomla (svenbluege.de) affects versions below 6.5.0 and lets an attacker craft a malicious web page that silently performs shopping-cart actions on behalf of a logged-in site user, because those cart endpoints do not validate an anti-CSRF token. Exploitation requires the victim to be authenticated to a Joomla site running the vulnerable extension and to visit attacker-controlled content while that session is active; impact is limited to integrity (manipulation of cart state) with no confidentiality or availability loss, consistent with the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/C:N/I:L/A:N) rather than a worst-case reading of the vendor's 6.9 base score. No public exploit code or active exploitation has been reported, and the vendor has released version 6.5.0 as the fixed release.
CSRF in Event Gallery for Joomla before 6.5.0 allows a third-party site to upload images to an event and overwrite existing files with the same filename when an authenticated Event Gallery user with image-upload rights is tricked into loading an attacker-controlled page. The attacker does not need authentication, but the attack requires an active victim session and victim interaction; impact is limited to file integrity within event galleries, with no data theft or code execution. No public exploit identified at time of analysis; risk is low-to-moderate despite the medium CVSS.
Cross-site request forgery (CSRF) in the Event Gallery extension for Joomla (versions before 6.5.0) allows an attacker to trick an authenticated backend administrator into deleting orphaned file entries and shopping carts older than 30 days. The attack requires the victim to have an active session and to visit a malicious page; only stale, unreferenced data is affected, not live content. No public exploit code has been identified, and the issue is considered low priority despite a CVSS 4.0 score of 5.1.
Reflected cross-site scripting and open redirect in Event Gallery for Joomla before 6.5.0 allow unauthenticated remote attackers to redirect victims or execute script in their browser if they click a crafted link containing a base64-encoded 'return' parameter. The extension decodes that parameter and writes it into the 'Back' link without validation, but exploitation requires user interaction and the vulnerable extension must be installed. No public exploit identified at time of analysis; the issue is assessed as moderate and low priority with client-side impact only.
Cross-site request forgery (CSRF) in the EasyStore extension for Joomla (versions 1.0.0 through 3.0.0) allows a remote unauthenticated attacker to trick a logged-in victim into submitting unauthorized product reviews or review spam via the product.addReview endpoint. The flaw stems from commented-out anti-CSRF token verification, and exploitation requires the victim to visit attacker-controlled content while authenticated. No public exploit code or active exploitation has been identified at time of analysis, and the impact is limited to low integrity (unauthorized reviews) without confidentiality or availability loss.
Reflected cross-site scripting in regularlabs.com's Articles Anywhere (versions before 20.0.0) and Users Anywhere (versions before 2.1.0) extensions for Joomla allows unauthenticated remote attackers to inject executable JavaScript into victims' browsers. The extensions expose a data-tag templating system that pulls values from visitor-controlled request parameters and renders them in output without context-sensitive encoding - Joomla's built-in string input filter does not distinguish between safe-for-HTML-text, safe-for-attribute, and safe-for-URL contexts, so a malicious request value can materialize as an event handler attribute or a javascript: URL wherever a site author has placed a data tag. No public exploit identified at time of analysis.
SP Property, a Joomla real estate listing extension by joomshaper.com, exposes gallery image management controller tasks without authorization checks or CSRF token validation in versions prior to 4.1.4. Unauthenticated remote attackers can invoke file deletion against arbitrary path strings and upload files of any type to the server. The unrestricted file upload primitive is particularly dangerous - if the upload directory is web-accessible, which is typical for Joomla component image managers, an attacker can deploy a PHP web shell and achieve full server-side code execution, making the realistic impact far more severe than the CVSS 4.0 score of 6.9 indicates.
SP Property, a Joomla real estate extension by joomshaper.com, allows unauthenticated remote attackers to redirect booking inquiry emails to arbitrary destinations by manipulating client-submitted hidden form fields that control recipient routing. Versions 1.0.0 through 4.1.3 are affected; vendor-released patch version 4.1.4 addresses the flaw by moving recipient resolution server-side. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires no authentication against any publicly accessible property booking form.
The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction.
Insufficient input validation in the Easy Discuss component for Joomla allows authenticated users to inject persistent cross-site scripting (XSS) payloads through user avatar text fields. An attacker with valid credentials can exploit this to execute malicious scripts in the browsers of other users viewing affected content. The vulnerability affects Joomla installations using the vulnerable Easy Discuss component, with no patch currently available.
Stored cross-site scripting in Joomla's Easy Discuss component allows authenticated users to inject malicious scripts into forum posts due to insufficient input validation. An attacker with login credentials can execute arbitrary JavaScript in the browsers of other users viewing affected posts, potentially leading to session hijacking or credential theft. No patch is currently available for this vulnerability.
Lack of output escaping leads to a XSS vector in the pagebreak plugin. [CVSS 6.1 MEDIUM]
Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags. [CVSS 6.1 MEDIUM]
Cross-site request forgery (CWE-352) affects the JDownloads extension for Joomla across versions 1.0.0 through 4.0.47, exposing several request handlers that lack effective anti-CSRF token validation. Exploitation is network-based but indirect: an unauthenticated attacker must persuade a logged-in Joomla administrator or user with the component installed to load a crafted page or link, after which the victim's own session is abused to perform unauthorized actions with limited confidentiality and integrity impact (CVSS 3.1 5.4, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N). There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is very low at 0.12% (2nd percentile), making this a moderate-severity, low-priority issue that nevertheless warrants patching.
Reflected cross-site scripting in VirtueMart versions 1.0.0 through 4.4.10 for Joomla lets an unauthenticated attacker craft a malicious URL that executes script in the browser of any shop user who clicks it (CVSS 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Because the flaw is reflected rather than stored, every target must be individually social-engineered, which keeps the practical blast radius small and confines impact to the victim's browser session (low confidentiality and integrity, no availability effect). Exploitation is not confirmed as active and no public exploit code has been identified at time of analysis; EPSS is 0.20% (9th percentile), so this is a modest-priority item rather than an emergency.
SQL injection in Joomla mod_vvisit_counter v2.0.4j3.
Missing Authorization vulnerability in Mojoomla School Management allows Exploiting Incorrectly Configured Access Control Security Levels.2.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A SQL injection vulnerability in the JS Jobs plugin versions 1.3.2-1.4.4 for Joomla allows low-privilege users to execute arbitrary SQL commands. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A SQLi vulnerability in DJ-Classifieds component 3.9.2-3.10.1 for Joomla was discovered. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site request forgery (CSRF) in the Gridbox extension for Joomla before 2.20.4.0 allows unauthenticated attackers to install arbitrary language packs by tricking a logged-in administrator (or any user with the core.tools permission) into visiting a crafted URL. The PagesController's addLanguage action fails to enforce the POST method, bypassing Joomla's session-token validation, which is only applied to POST requests. No public exploit code was identified at time of analysis; exploitation requires user interaction (the victim must be authenticated with core.tools).
Unauthenticated SQL injection in the OrdaSoft Simple Membership extension for Joomla (versions before 7.4.0) allows any remote attacker to read and manipulate the site's backend database through crafted input to the checkLoginPass task. The site/simplemembership.php endpoint dispatches task=checkLoginPass with no authentication or access-control check and concatenates the login request parameter straight into a SQL query with no escaping or parameterization, which scores 9.3 under CVSS 4.0 with PR:N and no user interaction required. Exploitation needs only that the component be installed and enabled on a publicly reachable Joomla site - no credentials, user interaction, or non-default setting - and no public exploit identified at time of analysis.
Unauthenticated remote attackers can download any customer's purchased digital goods from Joomla sites running the Phoca Cart extension (versions 5.0.0 through 6.1.8), because the order-file download endpoint checks only that the 'd' (download token) and 'o' (order token) parameters are non-empty instead of comparing them with the stored download_token and order_token values. Any guest with no account can enumerate sequential numeric order IDs, supply arbitrary non-empty token values, and retrieve files belonging to other customers, making this a high-severity confidentiality breach with no authentication and no user interaction required (CVSS 4.0 base 8.7; assessed CVSS 3.1 7.5, C:H/I:N/A:N). No public exploit code was identified at time of analysis, and the issue is a genuine high-priority concern rather than an inflated score, with impact limited only by the practical prerequisite that the store actually offers downloadable goods served through this endpoint and has existing order records to enumerate.
Unauthenticated SQL injection in OrdaSoft Joomla CCK before 8.3.16 allows remote attackers to execute arbitrary SQL via the user-supplied order column for records, compromising the confidentiality, integrity, and availability of the Joomla database. The flaw affects only sites that have installed this third-party CCK extension, so prevalence is the main limiting factor; no public exploit code was identified at time of analysis, and there is no KEV confirmation of active exploitation. With a CVSS 4.0 score of 9.3 and an independent CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:N/C:H/I:H/A:H, this is a high-priority issue for affected deployments.
Unauthenticated remote code execution in OrdaSoft Joomla CCK (all versions below 8.3.16) lets any remote attacker who can reach the component's frontend upload and execute arbitrary PHP, resulting in full compromise of the Joomla site - the CVSS 4.0 base score is 10.0 and the independent CVSS 3.1 assessment is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The upload endpoint site/uploader.php is reachable through the component's normal frontend routing via task=getContent with no authentication or ACL check anywhere in the dispatch chain, and the shipped source has its file-extension allow-list commented out, so an image/PHP polyglot carrying an attacker-chosen .php extension passes the magic-byte MIME check and is written to an executable path under the Joomla web root. Exploitation requires no privileges, no user interaction, and no non-default configuration - only that the extension be installed and its frontend be web-reachable; the supplied CVSS v4.0 vector carries E:A (Exploit Maturity: Attacked), although no CISA KEV entry was supplied in the available intelligence, so that metric is the sole exploitation signal available here.
Unauthenticated SQL injection in the JCTables extension for Joomla (joomcode.com) through version 1.21.1 lets any remote attacker read and write arbitrary database content, because the extension's front-end CRUD API controller performs neither a Joomla token check nor any authentication check on any task. Table names, column names and values are taken directly from request parameters and concatenated into SQL, so a default install with the extension's front-end endpoint reachable is exploitable by an unauthenticated attacker with no user interaction and no non-default configuration (CVSS 4.0 base 10.0; our independent assessment concurs this is a top-tier priority rather than a high-score/low-risk case). Exposure is limited to Joomla sites that actually have this specific third-party extension installed, and no confirmed public exploit code was identified in the available intelligence at time of analysis, although public research describing a read/write SQLi-to-RCE chain has been published.
Unauthenticated remote code execution in the Balbooa Forms extension for Joomla (versions before 2.4.3.4) lets a visitor submit a crafted public form that results in attacker-controlled PHP being evaluated server-side. The root cause is that the extension substitutes form-field shortcodes with the raw value submitted by the visitor before passing administrator-defined 'PHP after submission' code to eval(), allowing a value to break out of a double-quoted PHP string. Exploitation is conditional, not blanket: it requires an administrator to have enabled the optional PHP-after-submission action and to have interpolated an attacker-controllable field shortcode inside a double-quoted string, a non-default configuration reflected as AT:P. No public exploit code or confirmed active exploitation was identified at time of analysis, and no CPE string was supplied; the vendor scores this 9.5 (critical) whereas our independent CVSS 3.1 assessment is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Unauthenticated path traversal in Balbooa Forms (a Joomla extension) before 2.4.3.4 allows remote attackers to exfiltrate local files readable by the Joomla process via crafted upload-field JSON during public form submission. The flaw requires that the target form has both the 'auto reply' and 'attach uploaded files' options enabled, limiting exploitability but still posing high risk given the CVSS 4.0 score of 8.9 and no authentication or user interaction required. No public exploit code has been identified at time of analysis, and no active exploitation has been confirmed via CISA KEV.
Stored cross-site scripting in the Balbooa Forms extension for Joomla (all versions before 2.4.3.4) allows an unauthenticated attacker to embed script code in the original multipart filename of a file uploaded through any public-facing form that offers an upload field. The filename is saved verbatim to the component's attachments table and, when a Joomla administrator later opens the attacker's submission in the backend, the component's JavaScript concatenates that stored filename into an HTML string assigned to innerHTML, executing the script in the administrator's session; there is no public exploit identified at time of analysis, and while the vendor scores this CVSS 4.0 8.6, our independent assessment rates it CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N because the payload only fires on privileged human interaction and has limited confidentiality and integrity impact.
Unauthenticated SQL injection in the OrdaSoft Book Library (Free) extension for Joomla, affecting all versions below 6.4.6, allows remote attackers to inject arbitrary SQL into an ORDER BY clause via the field and direction request parameters handled by the books() function in site/booklibrary.php. Because the injection lands in an unquoted ORDER BY position, the extension's keyword-blacklist filter (protectInjectionWithoutQuote()) can be defeated with a trailing decoy comment such as '-- xselect' that makes the filter merely quote the value instead of rejecting it, and exploitation requires only a prior request to prime session-stored sort defaults before the vulnerable code path is reached. Both the vendor's CVSS 4.0 vector (9.3, AV:N/AC:L/AT:N/PR:N/UI:N, high C/I/A) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicate a fully unauthenticated, low-complexity, network-reachable flaw with high confidentiality, integrity, and availability impact; no public exploit code and no CISA KEV entry were identified at time of analysis.
Unauthenticated SQL injection in the OrdaSoft Real Estate Manager (Free) extension for Joomla before 6.7.9 allows remote attackers to inject arbitrary SQL through the order_field parameter, which is concatenated unquoted into the ORDER BY clause of three public frontend property-listing queries (category browsing, search results, and full listing). Because the injection point is exposed on pre-authentication pages with no login, user interaction, or non-default configuration required, any reachable installation is at risk; the assessed impact is high confidentiality loss (blind extraction of database contents), while the ORDER BY sink constrains the attacker to data-read techniques rather than direct modification. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the only reference supplied is the vendor site, so patch status should be verified directly with OrdaSoft.
Unauthenticated SQL injection in the Vehicle Manager (Free) extension for Joomla versions prior to 6.5.8 allows remote attackers to inject SQL code via the order_field and order_direction parameters at three frontend entry points (category listing, search, and all-vehicles listing). Because the injection point is an unquoted ORDER BY clause, exploitation is constrained to blind/inferential techniques, but it can still lead to high confidentiality impact (e.g., extraction of sensitive database contents) with limited integrity and availability impact. No public exploit code has been identified, and the vulnerability requires no authentication or non-default configuration, making any public-facing installation a potential target; however, the overall real-world priority is moderate due to the product's footprint.
Stored cross-site scripting in Regular Labs Tabs & Accordions Pro versions 2.3.0 through 3.1.0 lets an authenticated Joomla user who can author or edit articles plant a JavaScript-executing browser URL scheme in a tab/accordion item's url option; the extension writes that value into a generated data-rlta-url attribute and the browser code later passes it to window.open() when the item is activated. Because the payload is stored as ordinary plugin syntax at save time, Joomla's article filtering does not catch it, and the executable behavior only materializes at render/interaction time. The vendor vector (CVSS 4.0 7.5, AV:N/AC:L/AT:P/PR:H/UI:N) and our independent assessment (CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) agree that exploitation requires privileged, authenticated content-authoring access and a victim who actively activates the affected item, so this is a genuinely moderate, not high, real-world risk; no public exploit code has been identified at time of analysis.
Server-side request forgery and local file inclusion in Regular Labs Modules Anywhere for Joomla (Pro versions 1.5.0 through 9.0.5) allow an attacker with content-authoring privileges to override module parameters and cause the server to open attacker-influenced URLs or local files. The parameter-override feature is enabled by default and applies attributes without verifying who authored the content containing the module tag; Joomla's core Feed module with its rssurl parameter is a confirmed vector. The vendor rates this 8.5 under CVSS 4.0, but the independent assessment (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) indicates high technical impact with moderate real-world priority because authentication is required and exposure depends on the selected module; no public exploit was identified at time of analysis.
Authenticated directory deletion in the Event Gallery extension for Joomla (svenbluege.de) below version 6.5.0 allows a high-privileged Joomla backend user to supply a traversal payload in the `images` parameter of the `cache.process` clear-cache task and recursively delete any directory the web server account is permitted to write to. The impact is confined to integrity and availability of web-server-writable paths - there is no confidentiality loss (VC:N/SC:N) and no privilege gain beyond the actor's existing administrator-level access, which is the main limiting factor (PR:H), giving a CVSS 4.0 base score of 7.0. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the root cause is a CWE-22 path traversal that accepts unsanitised relative paths before file deletion.
Unauthenticated path traversal in the lomart.fr UP extension for Joomla (versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29) allows remote attackers to read files outside the intended plugin directory, exposing configuration files, credentials and other sensitive data under the web root's readable filesystem. The reported CVSS 4.0 score is 9.2, and the independently assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms a confidentiality-only impact with no authentication or user interaction required, while integrity and availability remain unaffected. Real-world risk is governed by deployment scope rather than exploitability: this is a niche third-party Joomla extension, no public exploit was identified at time of analysis, and only sites that have the plugin installed and enabled at an affected version are exposed.
Unauthenticated remote code installation in the lomart.fr 'UP' plugin for Joomla (versions 5.0.0-5.2.0 and 6.0.0-6.0.29) allows remote attackers to write and install arbitrary code on affected sites without authentication, user interaction, or non-default configuration, as reflected in the vendor's CVSS 4.0 base score of 10.0. The flaw is a path traversal (CWE-22) that lets attacker-supplied paths escape the intended directory and place executable content where the web server will run it, giving full compromise of confidentiality, integrity, and availability on the host and follow-on systems. This is a niche, single-vendor Joomla add-on, so exposure depends entirely on whether the plugin is installed and active; no public exploit has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing).
Unauthenticated SQL injection exists in the lomart.fr UP Plugin for Joomla at versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29, letting remote attackers reach the plugin's vulnerable request handlers and inject arbitrary SQL into backend database queries; the vendor-assigned CVSS 4.0 vector (8.3, AV:N/AC:L/AT:P/PR:N/UI:N) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) both describe a network-reachable, no-authentication, no-user-interaction flaw capable of returning or altering stored data. Only Joomla sites that actually have this third-party extension installed and expose the affected endpoint are in scope, and the plugin's comparatively small install base limits the overall attack surface; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV). Successful exploitation depends on the injectable feature being reachable in the target deployment, which is why the CVSS 4.0 vector carries the AT:P attack-requirement flag.
Authenticated PHP code injection in the lomart.fr UP Plugin for Joomla (versions 5.0.0-5.2.0 and 6.0.0-6.0.29) allows a high-privilege administrator to execute arbitrary PHP code and system commands on the underlying server. The flaw requires a valid Joomla administrator account (PR:H) and is remotely exploitable without user interaction, but no public exploit code or active exploitation has been identified at time of analysis. Because the plugin is a narrowly deployed third-party extension and no vendor patch is available, the real-world priority is low despite the critical CVSS score (9.4), with mitigation limited to removing the plugin or tightly restricting administrative access.
Unauthenticated arbitrary file deletion in the AcyMailing Enterprise extension for Joomla (versions before 11.1.0) allows a remote attacker to store an arbitrary filesystem path - including paths that traverse outside the configured upload directory, such as configuration.php - in a file-type custom field and have the extension delete that file when the field is subsequently cleared. Exploitation requires a publicly reachable subscription or profile form that has a file-type custom field configured, so a default installation without such a field is not affected; the CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H) confirms network reachability, low complexity, no privileges required and no user interaction, with high integrity and availability impact but no confidentiality impact, reflecting a purely destructive outcome rather than data theft. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor has released a fixed version.
Unauthenticated remote code execution in AcyMailing Enterprise for Joomla (versions before 11.1.0) lets anyone who can email the address monitored by the extension's 'mailbox action' feature write a PHP file into the site's web root, because inbound MIME parts are stored under media/com_acym/upload/ with no extension check (CWE-434); once reachable over HTTP and PHP-executable, that file runs as the web-server account. The gating precondition is that mailbox monitoring is enabled and the upload path is web-exposed, which is not a default configuration, but where it applies exploitation is trivial and requires no authentication (CVSS 4.0 9.5 with AT:P; independent assessment CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, with the scope change reflecting impact escaping the extension into the hosting Joomla site). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the vendor-released fix is AcyMailing Enterprise 11.1.0.
Unauthenticated SQL injection in the joomlaboat.com YouTube Gallery extension for Joomla (versions below 5.7.3) lets remote attackers inject arbitrary SQL into read queries through the video search and sorting parameters of the public-facing gallery. No credentials, user interaction, or non-default configuration are required - only that the extension is installed and its video search/sorting front end is reachable, which is its normal deployment state. The CNA rates it 9.3 under CVSS 4.0, our independent assessment scores it as high severity with confidentiality impact dominant (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L), and no public exploit code or confirmed active exploitation was identified at time of analysis. Impact is bounded by deployment scope: core Joomla installations without this third-party extension are not affected, but any site that does run it is exposed to unauthenticated database disclosure.
EasyStore for Joomla versions 1.0.0 through 3.0.0 does not enforce CSRF token verification across most administrator AJAX endpoints, enabling an attacker to trick a logged-in Joomla administrator into changing store data such as orders, coupons, media, customers, settings, tags, categories, reviews, and collections. Only the products() action checked tokens; the vendor fix moves verification into ApiController::execute() and applies Session::checkToken() to POST, PUT, PATCH, and DELETE requests. No public exploit code was identified at time of analysis, and exploitation requires an active admin session plus user interaction, so this is a moderate-risk CSRF issue despite the potential for high integrity and availability impact.
PII harvesting in JoomShaper EasyStore 1.0.0-3.0.0 allows unauthenticated attackers to enumerate guest checkout records via the checkout.searchGuestUser endpoint, which returns full shipping details (name, phone, address) for any supplied email address. Despite vendor labeling as an authenticated SQL injection, the endpoint requires no authentication or session validation and enables bulk collection of customer PII. No public exploit code has been identified at time of analysis; the vendor has resolved the issue by removing the server-side endpoint and migrating autofill to client-side localStorage.
Authenticated SQL injection in the Easy Store extension for Joomla (versions 1.0.0 through 3.0.0) allows a Joomla administrator to inject arbitrary SQL through the coupon bulk update task at administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdate. The flaw is a genuine injection (reported as CWE-74, functionally classic CWE-89 SQLi) where coupon IDs are concatenated straight into raw SQL IN (...) clauses instead of being cast to integers or parameterized. Exploitation is confirmed to require high privilege (PR:H in the assessed CVSS:3.1 vector), and there is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is low at 0.25% (14th percentile), so despite the 8.6 headline score the practical priority is moderate-to-low because Joomla administrators already hold broad database-level trust.
Authenticated Joomla backend users of any privilege level can bypass EasyStore's ACL checks and edit arbitrary records in versions 1.0.0 through 3.0.0. The allowEdit() method in ApiController.php is hardcoded to return true, defeating Joomla's component- and asset-level permission model (CWE-284). The vendor rates this high severity (CVSS 8.6), though our independent assessment confirms the attack requires an existing backend account and is not exploitable by unauthenticated visitors; no public exploit identified at time of analysis.
Unauthenticated PII harvesting in the JoomShaper Easy Store extension for Joomla (versions 1.0.0 through 3.0.0) allows anyone to retrieve guest checkout records by submitting an email address to the checkout.searchGuestUser endpoint, which returns full name, phone number, street address, city, postal code and country directly from the #__easystore_guests table with no authentication, session validation or ownership check. Attackers can script the endpoint against purchased or scraped email lists to enumerate guest customers and compile sensitive personal data at scale, with no user interaction required. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but the attack is trivially reachable; yield depends on email-list quality and on whether a given site has actually used guest checkout, since only matching guest emails return data.
Remote code execution in the OrdaSoft Joomla Gallery extension (both the free and the commercial editions) before version 6.2.7 lets an authenticated Joomla backend user holding the core.manage permission upload a .php file into a web-accessible directory and execute it simply by requesting the resulting URL, giving full control of the Joomla host under the web server's account. The root cause is the extension's saveWatermark() routine, which stores the client-supplied filename exactly as sent with no extension check, no content check and no filename sanitisation, so a spoofed image Content-Type header is sufficient to smuggle a PHP payload through the upload path. Scoring is severe (vendor-assigned CVSS 9.4; our independent CVSS 3.1 assessment is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and although exploitation is gated on a privileged authenticated role rather than an anonymous visitor, no public exploit code has been identified at time of analysis.
Unauthenticated SQL injection in the OrdaSoft Joomla Gallery extension for Joomla (both the free and paid editions) below version 6.2.7 allows any anonymous visitor to inject SQL through the publicly published mod_osgallery_search search box and read arbitrary database content. The showSearchResult() and showSearchResultAjax() endpoints take the textsearch/searchText request parameter and concatenate it directly into a LIKE clause without quoting or escaping, and the CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) and the accompanying CVSS:3.1 assessment (PR:N/UI:N) both confirm the attack needs no authentication, no user interaction, and no special client configuration. Impact is scoped primarily to data disclosure - the authoritative assessment scores C:H/I:L/A:N because the injection point is a SELECT's LIKE clause - and no public exploit code was identified at time of analysis; exploitation is limited to sites running an affected Gallery version that actually publish the search module. This is a genuine high-priority vulnerability, so prioritise inventory of Joomla sites with the extension and the search module enabled, and upgrade to 6.2.7 or later.
Authenticated SQL injection in the OrdaSoft Joomla Gallery extension (both Free and commercial editions) for Joomla versions below 6.2.7 allows a user holding the delegated core.manage permission for the gallery component to execute arbitrary SQL against the site's database, including UNION-based extraction of #__users password hashes and full read/write access to stored data. Exploitation requires a valid Joomla account with that scoped gallery-management right - there is no unauthenticated path - so exposure is concentrated on sites that delegate gallery administration to non-fully-trusted users. No public exploit code or confirmed active exploitation was identified at the time of analysis, and no EPSS or KEV data was supplied; severity is assessed as high (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, vendor-published CVSS 8.6).
Authenticated remote code execution in OrdaSoft Joomla Gallery (both the free and commercial editions) for Joomla below version 6.2.7 lets anyone holding a privileged Joomla backend account execute arbitrary PHP functions on the underlying server. The extension's updateOSGallery() handler, invoked through task=update_osgallery, takes a JSON body and calls the supplied 'method' value as a live PHP function with the 'package' value as its only argument, with no is_callable() check or allow-list, so functions such as system, exec, shell_exec and passthru are directly reachable. Rated CVSS 9.4 (CVSS 4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H; independently assessed as CVSS 3.1 scope-changed with C:H/I:H/A:H); exploitation requires authentication with a high-privilege role, which is the main limiting factor - this is not reachable by anonymous internet users, and no public exploit code was identified at time of analysis.
Arbitrary file rename across the Joomla filesystem is possible in SP Page Builder (Free and Pro) versions 4.0.0 through 6.9.0 due to missing directory confinement in the media rename controller task. Authenticated administrators or users with media management permissions can pair any valid media identifier with an unrelated filesystem path, bypassing the boundary checks that protect other folder operations in the same controller. An attacker exploiting this flaw can rename files outside the intended media directory - including renaming configuration.php - effectively taking the entire Joomla site offline or disrupting its integrity. No public exploit or active exploitation has been identified at time of analysis.
Authenticated SQL injection in JoomShaper's SP Page Builder Joomla extension (versions 5.2.1-6.9.0) lets backend-privileged users perform time-based blind SQL injection against the full Joomla database, including credential hash and active session tables. The `plgContentSppagebuilder::onContentAfterSave()` content plugin method directly concatenates a POST-supplied array element into a raw SQL `WHERE` clause without quoting or integer casting, and Joomla's own ARRAY input filter provides no sanitization of element values. No public exploit code has been identified at time of analysis, and SSVC rates exploitation status as none.
Stored cross-site scripting in the Regular Labs Snippets extensions for Joomla (Free < 7.0.0, Pro < 11.0.0) allows a lower-privileged Joomla author to inject malicious script into Snippet content by passing an unsafe value through the extension's article tag variable substitution mechanism, specifically via the url option. Because the affected versions do not validate the article author's trust level before substituting their tag-supplied variables into security-sensitive positions defined by a trusted Snippet author, the injected payload executes in the browser of any higher-privileged user who views the rendered article. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Regular Labs' Conditional Content Pro extension for Joomla (versions before 8.0.0) lets an author with article-publishing rights embed inline PHP inside Condition Rules, which the extension hands to its Conditions evaluator without verifying who authored the content. Because Joomla's standard Author text filter preserves the rule syntax, publishing a crafted article executes the attacker's PHP as the web-server process. No public exploit has been identified at time of analysis, and the flaw requires an authenticated, privileged Joomla account.
Stored cross-site scripting in the Regular Labs Modals extension for Joomla (all versions before 17.0.0) allows high-privileged content authors to inject executable browser URL schemes - such as javascript: - into modal destination fields, which the extension passes unvalidated into both the generated anchor href and the iframe source path. When any site visitor subsequently renders the affected page, the stored payload executes as JavaScript in their browser without requiring the Pro JavaScript Events feature to be enabled. No public exploit has been identified at time of analysis; the vendor-released fix is version 17.0.0.
Stored XSS in regularlabs.com's Articles Anywhere Joomla extension (versions prior to 20.0.0) lets authenticated article authors inject arbitrary JavaScript via link event handler options (onclick, onmouseover) in plugin syntax tags. The injected payload bypasses Joomla's built-in Author content filter because Articles Anywhere renders the event handler attributes into live HTML after the CMS filter has already processed the content. No public exploit has been identified at time of analysis, but the filter-bypass is architectural and cannot be mitigated without patching.
Stored cross-site scripting in the Modals Pro extension for Joomla (regularlabs.com) versions prior to 17.0.0 allows an authenticated Author-level user to inject executable JavaScript via documented event handler options (on-open, on-closed) embedded in article content. The extension intentionally supports JavaScript lifecycle events for modal dialogs but fails to enforce access control distinguishing which roles may supply executable code versus static configuration parameters - enabling a lower-privileged author to weaponize a trusted-user feature. When a higher-privileged user views the crafted article, the modal fires the injected script in their browser context. No public exploit or CISA KEV listing exists at time of analysis.
Stored cross-site scripting in regularlabs.com's Tabs & Accordions (Free and Pro) extension for Joomla, versions prior to 3.1.0, allows a privileged authenticated attacker to inject and permanently persist arbitrary JavaScript into page output by supplying a crafted value in the rtla-alias configuration field. The extension's link-rewriting renderer embeds the alias directly into an HTML onclick attribute as a JavaScript string argument, applying neither JavaScript-string escaping nor HTML-attribute encoding, so a crafted alias breaks both quoting contexts and executes in every subsequent visitor's browser. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored XSS in SP Property (a Joomla real estate extension by joomshaper.com) before version 4.1.4 allows unauthenticated remote attackers to inject persistent JavaScript payloads into property listings and related content. Multiple template files across both frontend views and administrator list tables rendered user-supplied attributes and text values directly into HTML without contextual output escaping, enabling the stored payload to execute in the browser of any user who views the affected page - including Joomla administrators. No public exploit code has been identified and this vulnerability is not currently listed in CISA KEV, but the stored nature and admin-context execution make this a high-priority remediation target for any site running the affected extension.
Cross-site request forgery in SP Property (a Joomla real estate extension by joomshaper.com) before version 4.1.4 allows unauthenticated attackers to forge POST requests against two unprotected endpoints. The visitor property booking endpoint (properties.booking) and agent contact form endpoint (agents.sendmail) both processed POST submissions without validating Joomla's built-in session anti-CSRF tokens, enabling an attacker who tricks a site visitor into loading a malicious page to submit fraudulent bookings or send arbitrary contact messages on that visitor's behalf. No public exploit has been identified at time of analysis.
Unauthenticated SQL injection in JoomShaper's SP Property extension for Joomla (versions before 4.1.4) lets remote attackers inject SQL through the property search and map-filtering query builders. The zipcode, sorting, price_range_dropdown, and psize_range_dropdown parameters are concatenated directly into WHERE and ORDER BY clauses without quoting or type casting, enabling boolean- and time-based blind extraction of database contents. No public exploit has been identified and the flaw is not in CISA KEV, but the unauthenticated network-reachable vector makes it a high-priority patch.
Path traversal (Zip Slip) in Joomla 6.1.1's com_joomlaupdate component enables persistent remote code execution when a Super User is socially engineered into extracting a crafted ZIP archive via the administrator interface. The extract.php extraction routine failed to validate ZIP entry filenames for parent-directory sequences (`..`), absolute Unix paths, Windows drive letter paths, or UNC paths - allowing an attacker-supplied archive to write arbitrary PHP files outside the intended extraction root. No confirmed active exploitation (not in CISA KEV); an upstream patch is available via GitHub commit and PR, though a tagged patched release version has not been independently confirmed.
Arbitrary file upload in Joomla's Easy Discuss component allows authenticated attackers to bypass file validation by spoofing extensions, since the component relies solely on extension checks without verifying MIME types. An attacker with user privileges can upload malicious files to achieve remote code execution on affected systems. No patch is currently available.
An issue was discovered in Joomla!. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in Joomla!. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 94.5%.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 93.4%.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \". Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Joomla!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 92.9%.
SQL injection vulnerability in Joomla!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 69.1%.
SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.php in Joomla!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 72.2%.
SQL injection vulnerability in Joomla!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 91.6%.
Akeeba Restore (restore.php), as used in Joomla!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
administrator/components/com_media/helpers/media.php in the media manager in Joomla!. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 52.1%.
Path traversal in the Gridbox extension for Joomla (versions before 2.20.4.0) allows unauthenticated remote attackers to read image files outside the configured images root when a sibling directory sharing the root's name prefix exists. The flaw resides in the site UploaderHelper's prefix-only containment check used by the showImage action; a request-controlled path can resolve to a sibling directory such as 'images-backup' if that directory exists and contains a file with a Gridbox-permitted image extension. Exploitation is limited to image-type files and requires the presence of such a prefix-matching sibling directory; no public exploit code has been identified and CISA SSVC reports no exploitation activity, with independent assessment rating the risk Low.
Unauthenticated attackers can delete arbitrary slider images and replace the entire OrdaSoft Touch Slider database tables site-wide via the module's AJAX handler in versions below 5.4.6. The handler modOsTouchSliderHelper::getAjax() lacks any JFactory::getUser(), authorise(), or CSRF-token check, so exploitation requires no session or task parameter and works against default configurations where the module is installed and enabled. No public exploit identified at time of analysis.
Unauthenticated guests can force execution of any published automation task in TF Content for Joomla versions 2.9.0 through 2.9.4 by supplying a task's numeric ID to the records.custom_action endpoint. The extension lacks authentication, ACL, CSRF, task-trigger, content-binding, and cron-token enforcement, allowing immediate dispatch of the configured executor. No public exploit identified at time of analysis, and the risk is assessed as a genuine but mid-tier priority.
Server-side request forgery (SSRF) in Event Gallery for Joomla before 6.6.0 allows an attacker to make the server send the Google Photos OAuth access token to an arbitrary address or probe internal network resources. The vulnerability resides in the back-end upload page's Google Photos picker, which fetches image thumbnails using a user-supplied address without validation and without a form token, enabling exploitation via CSRF against a logged-in administrator or directly by a back-end user with 'Manage' permission. No public exploit code has been identified, and the risk is assessed as moderate and targeted.
Reflected cross-site scripting (XSS) in the Dynamic Content Filter addon of the SP Page Builder Pro extension for Joomla (versions 3.0.0 through 5.6.1p2) allows unauthenticated attackers to inject arbitrary HTML or JavaScript into a victim's browser by crafting a URL with a malicious dc_filter_<fieldId> parameter, provided the addon is used with a slider field. The flaw is rated medium severity (CVSS 4.0 base 5.3; independent assessment CVSS 3.1 base 5.3) and requires user interaction-the victim must load the crafted link. No public exploit code has been identified at time of analysis, and CISA KEV does not list active exploitation.
Reflected cross-site scripting and an open redirect in the front-end "share mini page" of the Joomla Event Gallery extension (svenbluege.de) affect all versions below 6.6.0. When the "Share article links" option is enabled, the article address carried in a crafted share link is rendered into the page without validation or output encoding, and when the link type is set to "Image Page with Redirect" the address is followed immediately, allowing an attacker to execute script in the browser session of any visitor who opens the prepared link or to silently redirect that visitor to an attacker-controlled site. The vulnerability is unauthenticated remote (CVSS 4.0 base 5.3; independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), requires a victim to click the malicious link, and no public exploit code has been identified at time of analysis; there is no server-side read or write, so impact is confined to the victim's browser session.
TF Content 2.9.0 through 2.9.4, a Joomla content extension distributed by joomlafry.com, allows unauthenticated remote attackers to create and modify arbitrary TF Content records because its public RecordController performs no authorization check and its shared frontend save controller writes the raw jform array without filtering it through the configured form. By pulling a valid Joomla token from the public login form and supplying an existing record ID, a guest - with no account, privileges, or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) - can mass-assign fields such as published, access, and created_by on any TF Content row. Impact is bounded to low confidentiality, integrity, and availability effects on TF Content data rather than full site compromise; no public exploit code or confirmed active exploitation was identified at time of analysis, placing this as a genuine but moderate-priority issue.
Cross-site request forgery in the Event Gallery extension for Joomla (all versions before 6.6.0) allows an attacker-controlled external page to silently flip back-end configuration flags - default payment method, shipping method, image type set, order status, watermark, putting an event in or out of the shop, selecting an event's main image, toggling the main-image-only flag, and sorting event images - in the name of an administrator. The eight affected back-end list buttons never validate the Joomla form token, so the forged requests execute with the privileges of a victim who has an active administrator session and visits the malicious page (user interaction required, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). Impact is deliberately narrow - no data can be read or deleted and orders are unaffected - so this is a medium/low-priority issue rather than a high-CVSS alarm; no public exploit code or confirmed active exploitation was identified at time of analysis, and the flaw is fixed in version 6.6.0.
Unauthenticated remote attackers can tamper with uploaded file metadata in Balbooa Forms for Joomla versions before 2.4.3.4 by exploiting insufficient validation of client-supplied filenames and display names during the final form submission. This allows cross-session file claiming and potential path traversal via the getFilePath() function, though the impact is limited to integrity with no confidentiality or availability loss. No public exploit code or active exploitation has been identified, and the CVSS 4.0 score of 6.9 overstates the real-world risk per independent assessment.
Unauthenticated guests can delete other users' temporary file attachments on Joomla sites running the Balbooa Forms extension below version 2.4.3.4. The public removeTmpAttachment action accepts an integer attachment ID and deletes the matching database row and file; the controller does verify a Joomla session token, but the model never ties that ID to the uploading session, user, form, upload field, or temporary state, so any guest can obtain a token for their own session and then destroy arbitrary pending uploads by enumerating valid integer IDs. Impact is confined to integrity of temporary/pending attachment records and files (CVSS 3.1 C:N/I:L/A:N, no confidentiality or availability effect), and no public exploit code has been identified at time of analysis.
Reflected cross-site scripting in the OrdaSoft Book Library (Free) extension for Joomla, affecting versions below 6.4.6, lets an unauthenticated remote attacker inject arbitrary HTML and JavaScript that executes in a victim's browser session. The flaw lives in the publicly reachable book-detail view (site/views/view_book/tmpl/default.php), where the 'title' request parameter is echoed raw inside a double-quoted HTML attribute, so a value containing a double quote breaks out of the attribute and everything after it is rendered as markup. Exploitation requires passive user interaction - the attacker must deliver a crafted link to a victim (UI:P) - and impact scales with the victim's privileges, so a lured logged-in administrator yields a far more serious outcome than an anonymous visitor; no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the first-party assessment rates this a genuine but modest-severity reflected XSS.
Reflected cross-site scripting in the ordasoft.com Real Estate Manager (Free) extension for Joomla before version 6.7.9 lets remote attackers execute arbitrary script in a victim's browser by luring them to a crafted URL. The flaw lives in the 'leave a review' form on the public property-detail page, where the review title is echoed from the request straight into a double-quoted HTML attribute with no escaping or filtering at all - a double-quote character in the title parameter breaks out of the attribute and permits a following <script> element to run. No authentication is required and the CVSS 4.0 base score is 5.3 (assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N); exploitation depends on the victim loading the malicious link, so it is not self-triggering, and no public exploit code was identified at time of analysis. Impact is contained to the tricked user's browser session, with no server-side compromise; this is a genuine but low-severity issue.
Stored cross-site scripting in TPVEnlanube enables an authenticated backend user to store malicious JavaScript in the 'Apellido 1' field of the Joomla/VirtueMart administrator user-add endpoint '/administrator/index.php?page=admin.user_add&user_id=45&option=com_virtuemart'; the payload executes in the browser of a privileged user or administrator who later views the affected user record. The flaw is not self-triggering and requires two actors-an authenticated low-privileged account to store the payload and an administrator to render it-so the assessed impact is low-to-moderate, limited to script execution in the victim's admin session, with no public exploit identified at time of analysis and no direct server-side code execution.
Stored cross-site scripting (XSS) in TPVEnlanube, a Joomla/VirtueMart payment gateway extension, allows an authenticated attacker to inject malicious script into the 'Nombre Completo' field, which then executes in the browser of any privileged user viewing the VirtueMart administrator user-list page (admin.user_list). The vulnerability affects all versions of the extension (CPE wildcard) and requires the victim to interact with the page. No public exploit has been identified, and the overall risk is assessed as low-to-moderate due to the need for authentication and user interaction, with impact limited to browser-based script execution rather than server compromise.
Stored cross-site scripting in TPVEnlanube allows an authenticated user with access to the VirtueMart store administration function to persist arbitrary script through the 'vendor_store_name' parameter at the '/administrator/index.php?pshop_mode=admin&page=store.store_add&option=com_virtuemart&vendor_id=[ID]' endpoint; the payload then executes in the browser of any administrator or user who later renders the poisoned store record. Exploitation is high-friction: it requires valid backend credentials (CVSS PR:L), reachability of the store-management feature, and a separate privileged victim who opens the affected record (UI:A), which caps the realistic impact at low-confidentiality/low-integrity for the victim's session. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; severity is low (CVSS 4.0 base 4.8).
Cross-site request forgery in the Event Gallery extension for Joomla (svenbluege.de) affects versions below 6.5.0 and lets an attacker craft a malicious web page that silently performs shopping-cart actions on behalf of a logged-in site user, because those cart endpoints do not validate an anti-CSRF token. Exploitation requires the victim to be authenticated to a Joomla site running the vulnerable extension and to visit attacker-controlled content while that session is active; impact is limited to integrity (manipulation of cart state) with no confidentiality or availability loss, consistent with the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/C:N/I:L/A:N) rather than a worst-case reading of the vendor's 6.9 base score. No public exploit code or active exploitation has been reported, and the vendor has released version 6.5.0 as the fixed release.
CSRF in Event Gallery for Joomla before 6.5.0 allows a third-party site to upload images to an event and overwrite existing files with the same filename when an authenticated Event Gallery user with image-upload rights is tricked into loading an attacker-controlled page. The attacker does not need authentication, but the attack requires an active victim session and victim interaction; impact is limited to file integrity within event galleries, with no data theft or code execution. No public exploit identified at time of analysis; risk is low-to-moderate despite the medium CVSS.
Cross-site request forgery (CSRF) in the Event Gallery extension for Joomla (versions before 6.5.0) allows an attacker to trick an authenticated backend administrator into deleting orphaned file entries and shopping carts older than 30 days. The attack requires the victim to have an active session and to visit a malicious page; only stale, unreferenced data is affected, not live content. No public exploit code has been identified, and the issue is considered low priority despite a CVSS 4.0 score of 5.1.
Reflected cross-site scripting and open redirect in Event Gallery for Joomla before 6.5.0 allow unauthenticated remote attackers to redirect victims or execute script in their browser if they click a crafted link containing a base64-encoded 'return' parameter. The extension decodes that parameter and writes it into the 'Back' link without validation, but exploitation requires user interaction and the vulnerable extension must be installed. No public exploit identified at time of analysis; the issue is assessed as moderate and low priority with client-side impact only.
Cross-site request forgery (CSRF) in the EasyStore extension for Joomla (versions 1.0.0 through 3.0.0) allows a remote unauthenticated attacker to trick a logged-in victim into submitting unauthorized product reviews or review spam via the product.addReview endpoint. The flaw stems from commented-out anti-CSRF token verification, and exploitation requires the victim to visit attacker-controlled content while authenticated. No public exploit code or active exploitation has been identified at time of analysis, and the impact is limited to low integrity (unauthorized reviews) without confidentiality or availability loss.
Reflected cross-site scripting in regularlabs.com's Articles Anywhere (versions before 20.0.0) and Users Anywhere (versions before 2.1.0) extensions for Joomla allows unauthenticated remote attackers to inject executable JavaScript into victims' browsers. The extensions expose a data-tag templating system that pulls values from visitor-controlled request parameters and renders them in output without context-sensitive encoding - Joomla's built-in string input filter does not distinguish between safe-for-HTML-text, safe-for-attribute, and safe-for-URL contexts, so a malicious request value can materialize as an event handler attribute or a javascript: URL wherever a site author has placed a data tag. No public exploit identified at time of analysis.
SP Property, a Joomla real estate listing extension by joomshaper.com, exposes gallery image management controller tasks without authorization checks or CSRF token validation in versions prior to 4.1.4. Unauthenticated remote attackers can invoke file deletion against arbitrary path strings and upload files of any type to the server. The unrestricted file upload primitive is particularly dangerous - if the upload directory is web-accessible, which is typical for Joomla component image managers, an attacker can deploy a PHP web shell and achieve full server-side code execution, making the realistic impact far more severe than the CVSS 4.0 score of 6.9 indicates.
SP Property, a Joomla real estate extension by joomshaper.com, allows unauthenticated remote attackers to redirect booking inquiry emails to arbitrary destinations by manipulating client-submitted hidden form fields that control recipient routing. Versions 1.0.0 through 4.1.3 are affected; vendor-released patch version 4.1.4 addresses the flaw by moving recipient resolution server-side. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires no authentication against any publicly accessible property booking form.
The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction.
Insufficient input validation in the Easy Discuss component for Joomla allows authenticated users to inject persistent cross-site scripting (XSS) payloads through user avatar text fields. An attacker with valid credentials can exploit this to execute malicious scripts in the browsers of other users viewing affected content. The vulnerability affects Joomla installations using the vulnerable Easy Discuss component, with no patch currently available.
Stored cross-site scripting in Joomla's Easy Discuss component allows authenticated users to inject malicious scripts into forum posts due to insufficient input validation. An attacker with login credentials can execute arbitrary JavaScript in the browsers of other users viewing affected posts, potentially leading to session hijacking or credential theft. No patch is currently available for this vulnerability.
Lack of output escaping leads to a XSS vector in the pagebreak plugin. [CVSS 6.1 MEDIUM]
Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags. [CVSS 6.1 MEDIUM]
Cross-site request forgery (CWE-352) affects the JDownloads extension for Joomla across versions 1.0.0 through 4.0.47, exposing several request handlers that lack effective anti-CSRF token validation. Exploitation is network-based but indirect: an unauthenticated attacker must persuade a logged-in Joomla administrator or user with the component installed to load a crafted page or link, after which the victim's own session is abused to perform unauthorized actions with limited confidentiality and integrity impact (CVSS 3.1 5.4, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N). There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is very low at 0.12% (2nd percentile), making this a moderate-severity, low-priority issue that nevertheless warrants patching.
Reflected cross-site scripting in VirtueMart versions 1.0.0 through 4.4.10 for Joomla lets an unauthenticated attacker craft a malicious URL that executes script in the browser of any shop user who clicks it (CVSS 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Because the flaw is reflected rather than stored, every target must be individually social-engineered, which keeps the practical blast radius small and confines impact to the victim's browser session (low confidentiality and integrity, no availability effect). Exploitation is not confirmed as active and no public exploit code has been identified at time of analysis; EPSS is 0.20% (9th percentile), so this is a modest-priority item rather than an emergency.
SQL injection in Joomla mod_vvisit_counter v2.0.4j3.
Missing Authorization vulnerability in Mojoomla School Management allows Exploiting Incorrectly Configured Access Control Security Levels.2.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A SQL injection vulnerability in the JS Jobs plugin versions 1.3.2-1.4.4 for Joomla allows low-privilege users to execute arbitrary SQL commands. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A SQLi vulnerability in DJ-Classifieds component 3.9.2-3.10.1 for Joomla was discovered. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.