Keyboard Shortcuts Extension For Joomla
Monthly
Broken CSRF token enforcement across 23 Regular Labs AJAX-based Joomla extensions allows authenticated lower-privileged users to directly invoke privileged endpoints, or allows any attacker to perform those operations via a cross-site request forgery attack against an authenticated victim. The affected surface spans virtually the entire Regular Labs extension portfolio, from Advanced Module Manager through Sourcerer, covering all versions from 1.0.0 up to per-extension maximums. No public exploit or active exploitation has been confirmed; EPSS is 0.13%, consistent with the UI:R requirement that prevents mass automated attack.
Cross-site scripting in the Keyboard Shortcuts extension for Joomla (versions 1.0.0-3.2.5) by Regular Labs allows injection of arbitrary JavaScript via the shortcut configuration interface, executing in the browser context of any user who subsequently triggers the affected shortcut. The Changed Scope (S:C) in the CVSS vector confirms script execution crosses into the victim's session context, enabling session hijacking, credential theft, or unauthorized site actions. No public exploit identified at time of analysis; EPSS at 0.21% (11th percentile) and SSVC exploitation status of 'none' both indicate low-probability opportunistic targeting.
Broken CSRF token enforcement across 23 Regular Labs AJAX-based Joomla extensions allows authenticated lower-privileged users to directly invoke privileged endpoints, or allows any attacker to perform those operations via a cross-site request forgery attack against an authenticated victim. The affected surface spans virtually the entire Regular Labs extension portfolio, from Advanced Module Manager through Sourcerer, covering all versions from 1.0.0 up to per-extension maximums. No public exploit or active exploitation has been confirmed; EPSS is 0.13%, consistent with the UI:R requirement that prevents mass automated attack.
Cross-site scripting in the Keyboard Shortcuts extension for Joomla (versions 1.0.0-3.2.5) by Regular Labs allows injection of arbitrary JavaScript via the shortcut configuration interface, executing in the browser context of any user who subsequently triggers the affected shortcut. The Changed Scope (S:C) in the CVSS vector confirms script execution crosses into the victim's session context, enabling session hijacking, credential theft, or unauthorized site actions. No public exploit identified at time of analysis; EPSS at 0.21% (11th percentile) and SSVC exploitation status of 'none' both indicate low-probability opportunistic targeting.