Joomlack Fr
Monthly
SQL injection in Page Builder CK for Joomla (versions before 3.6.5) lets attackers manipulate database queries through the extension's styles model, exposing the underlying database to unauthorized read and write. The flaw is exploitable remotely without authentication per the CVSS 4.0 vector (AV:N/PR:N/UI:N), with the frontend attack surface closed in 3.6.4 and the backend surface closed in 3.6.5. No public exploit identified at time of analysis, but the CWE-89 root cause and the reported 9.3 severity make this a high-priority patch for affected Joomla sites.
Authenticated arbitrary file upload in the Page Builder CK extension for Joomla (vendor joomlack.fr) allows a low-privileged authenticated user to upload a malicious file and achieve remote code execution on the host. The flaw (CWE-434) carries a CVSS 4.0 base score of 9.4 driven by high confidentiality, integrity, and availability impact plus subsequent-system impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated arbitrary file upload in the Joomlack Page Builder CK extension for Joomla allows remote attackers to upload executable (PHP) files and achieve full remote code execution on the host. Any Joomla site running this extension is exposed to complete compromise without credentials. No public exploit identified at time of analysis, though the CVSS 4.0 threat metric (E:A) supplied by the scoring source signals observed exploitation activity, and the maximum 10.0 score plus AU:Y (automatable) indicate this is highly attractive for mass scanning.
SQL injection in Page Builder CK for Joomla (versions before 3.6.5) lets attackers manipulate database queries through the extension's styles model, exposing the underlying database to unauthorized read and write. The flaw is exploitable remotely without authentication per the CVSS 4.0 vector (AV:N/PR:N/UI:N), with the frontend attack surface closed in 3.6.4 and the backend surface closed in 3.6.5. No public exploit identified at time of analysis, but the CWE-89 root cause and the reported 9.3 severity make this a high-priority patch for affected Joomla sites.
Authenticated arbitrary file upload in the Page Builder CK extension for Joomla (vendor joomlack.fr) allows a low-privileged authenticated user to upload a malicious file and achieve remote code execution on the host. The flaw (CWE-434) carries a CVSS 4.0 base score of 9.4 driven by high confidentiality, integrity, and availability impact plus subsequent-system impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated arbitrary file upload in the Joomlack Page Builder CK extension for Joomla allows remote attackers to upload executable (PHP) files and achieve full remote code execution on the host. Any Joomla site running this extension is exposed to complete compromise without credentials. No public exploit identified at time of analysis, though the CVSS 4.0 threat metric (E:A) supplied by the scoring source signals observed exploitation activity, and the maximum 10.0 score plus AU:Y (automatable) indicate this is highly attractive for mass scanning.