Regularlabs Com
Monthly
Stored cross-site scripting in the Regular Labs Snippets extensions for Joomla (Free < 7.0.0, Pro < 11.0.0) allows a lower-privileged Joomla author to inject malicious script into Snippet content by passing an unsafe value through the extension's article tag variable substitution mechanism, specifically via the url option. Because the affected versions do not validate the article author's trust level before substituting their tag-supplied variables into security-sensitive positions defined by a trusted Snippet author, the injected payload executes in the browser of any higher-privileged user who views the rendered article. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in Quick Index (Free/Pro) extension for Joomla allows a privileged attacker to inject persistent script payloads by supplying a crafted class configuration value that breaks out of its HTML attribute context. Because Quick Index generates executable HTML output after Joomla's built-in content security filter has already processed plugin syntax, the platform's native XSS protection cannot intercept the injected payload. All versions prior to 5.0.5 are affected; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Regular Labs' Conditional Content Pro extension for Joomla (versions before 8.0.0) lets an author with article-publishing rights embed inline PHP inside Condition Rules, which the extension hands to its Conditions evaluator without verifying who authored the content. Because Joomla's standard Author text filter preserves the rule syntax, publishing a crafted article executes the attacker's PHP as the web-server process. No public exploit has been identified at time of analysis, and the flaw requires an authenticated, privileged Joomla account.
Stored cross-site scripting in the Regular Labs Modals extension for Joomla (all versions before 17.0.0) allows high-privileged content authors to inject executable browser URL schemes - such as javascript: - into modal destination fields, which the extension passes unvalidated into both the generated anchor href and the iframe source path. When any site visitor subsequently renders the affected page, the stored payload executes as JavaScript in their browser without requiring the Pro JavaScript Events feature to be enabled. No public exploit has been identified at time of analysis; the vendor-released fix is version 17.0.0.
Stored XSS in regularlabs.com's Articles Anywhere Joomla extension (versions prior to 20.0.0) lets authenticated article authors inject arbitrary JavaScript via link event handler options (onclick, onmouseover) in plugin syntax tags. The injected payload bypasses Joomla's built-in Author content filter because Articles Anywhere renders the event handler attributes into live HTML after the CMS filter has already processed the content. No public exploit has been identified at time of analysis, but the filter-bypass is architectural and cannot be mitigated without patching.
Stored cross-site scripting in the Modals Pro extension for Joomla (regularlabs.com) versions prior to 17.0.0 allows an authenticated Author-level user to inject executable JavaScript via documented event handler options (on-open, on-closed) embedded in article content. The extension intentionally supports JavaScript lifecycle events for modal dialogs but fails to enforce access control distinguishing which roles may supply executable code versus static configuration parameters - enabling a lower-privileged author to weaponize a trusted-user feature. When a higher-privileged user views the crafted article, the modal fires the injected script in their browser context. No public exploit or CISA KEV listing exists at time of analysis.
Stored cross-site scripting in regularlabs.com's Tabs & Accordions (Free and Pro) extension for Joomla, versions prior to 3.1.0, allows a privileged authenticated attacker to inject and permanently persist arbitrary JavaScript into page output by supplying a crafted value in the rtla-alias configuration field. The extension's link-rewriting renderer embeds the alias directly into an HTML onclick attribute as a JavaScript string argument, applying neither JavaScript-string escaping nor HTML-attribute encoding, so a crafted alias breaks both quoting contexts and executes in every subsequent visitor's browser. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Remote code execution in Regular Labs Sourcerer for Joomla (versions before 14.0.0) allows unauthenticated attackers to inject and execute arbitrary PHP via {source} blocks. The extension parses {source} tags found anywhere in Joomla's final rendered HTML without reliably verifying where that content originated, so attacker-controlled reflected input reaching the page body gets evaluated as trusted code. Rated CVSS 4.0 10.0 (critical); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Server-Side Request Forgery (SSRF) in Cache Cleaner Pro extension for Joomla 1.0.0-9.7.6 allows unauthenticated remote attackers to access internal or reserved network services via crafted custom query URLs. With a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) the vulnerability is automatable and has total technical impact, though no public exploit or active exploitation has been detected. EPSS predicts a 0.18% likelihood of exploitation in the next 30 days.
Insufficient permission and CSRF token checks in the Modules Anywhere editor popup for Joomla allow authenticated users to view and modify restricted module data without proper authorization. The vulnerability affects all versions up to 8.4.1. No public exploit code or active exploitation is known at this time; the EPSS exploitation probability is low.
Information disclosure in Regular Labs Articles Anywhere and Users Anywhere extensions for Joomla allows unauthenticated remote attackers to view content that should be expired or unpublished. Date-sensitive query caching generates cache keys lacking a bounded time component, so results cached during a valid period persist and can be served after content becomes unavailable. No active exploitation or public proof-of-concept has been identified, and EPSS indicates a low probability of widespread exploitation.
Unauthenticated remote file disclosure in ReReplacer Pro extension for Joomla allows attackers to read arbitrary files outside the site directory via path traversal in XML include paths. The vulnerability affects versions 1.0.0 through 15.0.3 and has a CVSS 3.1 score of 7.5 (high confidentiality impact). No public exploit code or active exploitation has been reported, and EPSS indicates a very low probability of widespread exploitation.
Unauthorized database updates can be triggered via CSRF in the GeoIP extension for Joomla, affecting versions 1.0.0 through 6.3.8. An attacker can trick a logged-in Joomla administrator into submitting a request that performs unauthorized database modifications, potentially compromising all data confidentiality, integrity, and availability. EPSS indicates a low 0.13% exploitation probability, and no active exploitation or public exploit is known at this time.
Exposure of CDN credentials in administrator request URLs in the Cache Cleaner Pro extension for Joomla versions 1.0.0 through
Server-side request forgery in Regular Labs' Articles Anywhere Pro and Users Anywhere Pro extensions for Joomla allows unauthenticated attackers to access internal network services and write arbitrary files to web-accessible directories. The vulnerability stems from improper validation of content-controlled image URLs, which fetch and save remote responses without checking that they are images. No active exploitation or public exploit code has been reported, and EPSS indicates low exploitation probability.
Information disclosure in the GeoIP extension for Joomla 1.0.0 through 6.3.8 exposes MaxMind API credentials directly in request URLs. Unauthenticated remote attackers can intercept these credentials from network traffic or server logs, gaining unauthorized access to the victim’s MaxMind geolocation service. No active exploitation or public exploit code is known, and EPSS probability of exploitation is very low (0.19%).
Unsafe file extraction in the Joomla GeoIP extension (versions 1.0.0-6.3.8) enables remote code execution by writing files outside intended directories during update processing. The vulnerability (CWE-22) does not require authentication and is triggered when the extension extracts untrusted archive files. EPSS probability of exploitation is low (0.20%), and no active exploitation or public exploit is confirmed at this time.
Content tags in the Articles Anywhere and Modules Anywhere extensions for Joomla can ignore access controls, enabling unauthenticated remote attackers to view restricted or unpublished articles and modules. The vulnerability stems from improper authorization enforcement when ignore
Authentication bypass via IP spoofing in the IP Login extension for Joomla allows unauthenticated attackers to impersonate mapped accounts. The extension trusts forwarded client-IP headers without requiring a trusted proxy, enabling remote attackers to spoof the IP used for automatic login. No active exploitation has been confirmed, but the vulnerability is automatable and carries high integrity impact.
We need to produce a JSON object with all fields as plain-text strings. Input: CVE-2026-63265. Description: Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization. CVSS score 8.0, vector: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, CWE-352. EPSS 0.13% (percentile 3%). Reported by: Joomla (probably the vendor). CPE list: many extensions for Joomla. Tags list includes many extension names. SSVC: Exploitation: none, Automatable: no, Technical Impact: total. ENISA EUVD affected versions list for many extensions. References: regularlabs.com and vuldb.com. We must synthesize into a comprehensive analysis. Fields: - product_name: "1-3 words ONLY. The specific product or service name affected." Since it's multiple extensions, but the core issue is Regular Labs extensions for Joomla. I'll pick "Regular Labs Joomla Extensions" (1-3 words, "Regular Labs Joomla Extensions" is 3 words, fine. Could also say "Regular Labs for Joomla" but better to be specific. Description mentions "Privileged Regular Labs AJAX endpoints" so it's across many Regular Labs extensions. So product_name: "Regular Labs Joomla Extensions". This covers the vendor and platform. - summary: 2-3 sentence plain-language. Don't copy description. Original synthesis. Mention what vulnerability, affected product, what attacker can do, if actively exploited, POC, EPSS risk. This is a CSRF vulnerability allowing authenticated lower-privileged users or CSRF attacks to perform unauthorized actions. Starts with impact: "Cross-site request forgery (CSRF) in Regular Labs Joomla extensions allows authenticated lower-privileged users or CSRF attacks to invoke unauthorized AJAX lookups and mutations." Then "Affected extensions (e.g., Advanced Module Manager, Articles Anywhere, etc.) fail to consistent
Database corruption or site takeover in DB Replacer extension for Joomla versions 1.0.0 through 8.2.7 allows unauthorized backend users or CSRF attacks to perform database replacements, risking major data corruption. The vulnerability arises from inconsistent enforcement of Super User permission and CSRF token validation on administrative routes and replacement requests. No public exploit has been identified at time of analysis, and EPSS estimates a low 0.2% probability of exploitation.
We are tasked with generating a JSON analysis for CVE-2026-63280. We have the description, CVSS, CWE, EPSS, SSVC, tags, affected products, references. Need to synthesize all. Let's break down the input: - CVE: CVE-2026-63280 - Description: "Conditions administration did not consistently enforce tokens and component/mapped-item permissions." - CVSS: 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CWE: CWE-352 (Cross-Site Request Forgery) - EPSS: 0.13% (percentile 3%) - Reported by: Joomla - CPE: multiple from regularlabs.com for extensions (Advanced Module Manager, Conditional Content, Content Templater Pro, Rereplacer Pro) for Joomla. - Tags: CSRF, and the extension names. - SSVC: Exploitation: none, Automatable: no, Technical Impact: total - ENISA EUVD-ID: EUVD-2026-47812 - Affected versions from EUVD: listed for each extension. - References: [cveorg] (None) https://regularlabs.com/ ... maybe missing advisory? Only link to vendor homepage. No specific advisory. So patch status unclear. We need to produce a comprehensive analysis. First, product_name: The vulnerability affects multiple extensions from Regular Labs for Joomla. The primary affected product is a set of extensions, but we need to pick a concise name. Could be "Regular Labs Joomla extensions" or the specific one? Since it's multiple, maybe "Advanced Module Manager" or one of them. Description: "Conditions administration did not consistently enforce tokens and component/mapped-item permissions." That sounds like CSRF and permission issues in the admin interface of these extensions. From tags: CSRF. So likely a CSRF vulnerability in all these extensions. The CWE is CWE-352, consistent. Product name: I'll pick "Regular Labs Joomla Extensions" but that might be 3 words. Alternatively, the primary extension mentioned first in tags: "Advanced Module Manager Extension For Joomla" but that's many words. I'll go with "Regular Labs Extensions" (2 words) or "Regular Labs for Joomla"? The instruction
Arbitrary PHP code execution in the Regular Labs Sourcerer extension for Joomla versions 1.0.0 through 12.2.8 allows remote attackers with article editing access to execute arbitrary code on the server. The flaw stems from missing Super User checks in the Free edition and inconsistent permission enforcement across article owners, PHP/CSS/JavaScript settings, tag attributes, and file includes in the Pro edition. No public exploit or active exploitation is confirmed at this time, and the EPSS score indicates low exploitation probability (0.19%), though the CVSS base score is 9.8.
Authentication bypass in Regular Labs Joomla extensions (Advanced Module Manager, Conditional Content, Content Templater Pro, and ReReplacer Pro) allows remote attackers to circumvent IP and GeoIP-based access restrictions by spoofing forwarded headers, effectively granting unauthorized access to location-restricted content or modules. The vulnerability has a CVSS 7.5 (High) with no authentication or user interaction required, but EPSS predicts a very low likelihood of exploitation (0.19%), and no public exploit code or active exploitation has been identified at this time. Affected versions span multiple extensions, and organizations using GeoIP/IP rules should treat this as a moderate risk requiring prompt attention.
Predictable persistent login keys in IP Login extension for Joomla allow unauthenticated attackers to compromise accounts. Versions 1.0.0 through 6.2.5 generate keys using a non-cryptographic random generator with insufficient entropy, enabling brute-force guessing. No public exploit is known, but the low-entropy PRNG makes key prediction feasible.
Information disclosure in multiple Regular Labs Joomla extensions allows unauthenticated visitors to retrieve administrator-only content indexed via Smart Search. Affected extensions include Articles Anywhere, Conditional Content, Modules Anywhere, ReReplacer, Sourcerer, Snippets Pro, and Tabs & Accordions Pro. No public exploit or active exploitation is known, and EPSS probability is low (0.19%).
Insufficient access controls in Regular Labs Extension Manager for Joomla (versions 1.0.0–9.2.5) allow an unauthenticated attacker via CSRF or a low-privilege backend user to install, update, or remove extensions. Successful exploitation can lead to complete site compromise through the installation of a malicious extension. EPSS probability is low (0.13%) and no active exploitation or public exploit code has been identified.
Missing CSRF tokens, item-permission, and input-validation checks in Regular Labs Joomla extensions (Content Templater, ReReplacer, Snippets) allow unauthorized backend users or CSRF attacks to expose, create, or modify extension configuration and items. This high-severity flaw (CVSS 8.8) affects multiple versions, with low exploitation probability (EPSS 0.13%). No active exploitation or public exploit code has been identified.
Reflected cross-site scripting in regularlabs.com's Articles Anywhere (versions before 20.0.0) and Users Anywhere (versions before 2.1.0) extensions for Joomla allows unauthenticated remote attackers to inject executable JavaScript into victims' browsers. The extensions expose a data-tag templating system that pulls values from visitor-controlled request parameters and renders them in output without context-sensitive encoding - Joomla's built-in string input filter does not distinguish between safe-for-HTML-text, safe-for-attribute, and safe-for-URL contexts, so a malicious request value can materialize as an event handler attribute or a javascript: URL wherever a site author has placed a data tag. No public exploit identified at time of analysis.
Database field disclosure in four Regular Labs Joomla extensions - Advanced Module Manager, Conditional Content, Content Templater, and ReReplacer - allows an authenticated high-privilege user to read arbitrary database fields outside the intended scope. The Conditions editor feature accepts user-supplied database table and column names from the HTTP request, which are quoted as SQL identifiers (preventing SQL injection) but are not restricted to the tables and columns supported by Regular Labs integrations. An attacker with administrative access can therefore query unrelated database fields, potentially exposing sensitive Joomla database content such as user records or configuration values. No public exploit code or active exploitation is identified at time of analysis.
Directory enumeration via path traversal in the Modals Pro extension for Joomla 1.0.0–15.0.0 allows unauthenticated remote attackers to list unintended directories. Successful exploitation may expose directory structures and potentially manipulate gallery paths, though only low confidentiality and integrity impacts are reported. EPSS indicates a 0.20% exploitation probability, and no active exploitation or public exploit code is known.
Cross-site request forgery in the Cache Cleaner extension for Joomla allows an authenticated administrator with cache-management permission to be tricked into performing unauthorized URL purges due to inconsistent token validation. Affected versions 1.0.0 through 9.7.6 may experience limited confidentiality and integrity compromise. No public exploit or active exploitation has been identified, and the EPSS score is low (0.13%).
GeoIP rule bypass in Joomla Geo
Path traversal in the Cache Cleaner Pro extension for Joomla allows unauthenticated remote attackers to read and write arbitrary files outside the webroot through
Path traversal in the CDN for Joomla Pro extension for Joomla allows an attacker to check file paths outside the intended site directory via the versioning feature, exposing whether arbitrary files exist and their modification timestamps. The vulnerability has a local attack vector per its CVSS score of 6.2, indicating exploitation likely requires local access or specific configuration, and no active exploitation or public exploit code has been identified.
Cross-site scripting in the Keyboard Shortcuts extension for Joomla (versions 1.0.0-3.2.5) by Regular Labs allows injection of arbitrary JavaScript via the shortcut configuration interface, executing in the browser context of any user who subsequently triggers the affected shortcut. The Changed Scope (S:C) in the CVSS vector confirms script execution crosses into the victim's session context, enabling session hijacking, credential theft, or unauthorized site actions. No public exploit identified at time of analysis; EPSS at 0.21% (11th percentile) and SSVC exploitation status of 'none' both indicate low-probability opportunistic targeting.
Information disclosure in Regular Labs Joomla extensions (Users Anywhere and Articles Anywhere) allows authenticated users to access insufficiently restricted user fields via crafted content containing user tags, filters, or conditions. Attackers with low privileges can expose authentication-related data, raw user parameters, and restricted contact details. No public exploit or active exploitation has been identified at the time of analysis, and the EPSS score (0.23%) indicates low exploitation probability.
Stored cross-site scripting (XSS) in multiple Regular Labs Joomla extensions allows an authenticated content author to inject arbitrary JavaScript. The script executes in visitors' browsers, potentially stealing session tokens or performing actions on their behalf. No active exploitation or public exploit code has been identified; EPSS score indicates very low likelihood of exploitation.
Stored cross-site scripting in Regular Labs Conditional Content and related Joomla extensions enables authenticated administrators to execute
Stored cross-site scripting in the Regular Labs Snippets extensions for Joomla (Free < 7.0.0, Pro < 11.0.0) allows a lower-privileged Joomla author to inject malicious script into Snippet content by passing an unsafe value through the extension's article tag variable substitution mechanism, specifically via the url option. Because the affected versions do not validate the article author's trust level before substituting their tag-supplied variables into security-sensitive positions defined by a trusted Snippet author, the injected payload executes in the browser of any higher-privileged user who views the rendered article. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in Quick Index (Free/Pro) extension for Joomla allows a privileged attacker to inject persistent script payloads by supplying a crafted class configuration value that breaks out of its HTML attribute context. Because Quick Index generates executable HTML output after Joomla's built-in content security filter has already processed plugin syntax, the platform's native XSS protection cannot intercept the injected payload. All versions prior to 5.0.5 are affected; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Regular Labs' Conditional Content Pro extension for Joomla (versions before 8.0.0) lets an author with article-publishing rights embed inline PHP inside Condition Rules, which the extension hands to its Conditions evaluator without verifying who authored the content. Because Joomla's standard Author text filter preserves the rule syntax, publishing a crafted article executes the attacker's PHP as the web-server process. No public exploit has been identified at time of analysis, and the flaw requires an authenticated, privileged Joomla account.
Stored cross-site scripting in the Regular Labs Modals extension for Joomla (all versions before 17.0.0) allows high-privileged content authors to inject executable browser URL schemes - such as javascript: - into modal destination fields, which the extension passes unvalidated into both the generated anchor href and the iframe source path. When any site visitor subsequently renders the affected page, the stored payload executes as JavaScript in their browser without requiring the Pro JavaScript Events feature to be enabled. No public exploit has been identified at time of analysis; the vendor-released fix is version 17.0.0.
Stored XSS in regularlabs.com's Articles Anywhere Joomla extension (versions prior to 20.0.0) lets authenticated article authors inject arbitrary JavaScript via link event handler options (onclick, onmouseover) in plugin syntax tags. The injected payload bypasses Joomla's built-in Author content filter because Articles Anywhere renders the event handler attributes into live HTML after the CMS filter has already processed the content. No public exploit has been identified at time of analysis, but the filter-bypass is architectural and cannot be mitigated without patching.
Stored cross-site scripting in the Modals Pro extension for Joomla (regularlabs.com) versions prior to 17.0.0 allows an authenticated Author-level user to inject executable JavaScript via documented event handler options (on-open, on-closed) embedded in article content. The extension intentionally supports JavaScript lifecycle events for modal dialogs but fails to enforce access control distinguishing which roles may supply executable code versus static configuration parameters - enabling a lower-privileged author to weaponize a trusted-user feature. When a higher-privileged user views the crafted article, the modal fires the injected script in their browser context. No public exploit or CISA KEV listing exists at time of analysis.
Stored cross-site scripting in regularlabs.com's Tabs & Accordions (Free and Pro) extension for Joomla, versions prior to 3.1.0, allows a privileged authenticated attacker to inject and permanently persist arbitrary JavaScript into page output by supplying a crafted value in the rtla-alias configuration field. The extension's link-rewriting renderer embeds the alias directly into an HTML onclick attribute as a JavaScript string argument, applying neither JavaScript-string escaping nor HTML-attribute encoding, so a crafted alias breaks both quoting contexts and executes in every subsequent visitor's browser. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Remote code execution in Regular Labs Sourcerer for Joomla (versions before 14.0.0) allows unauthenticated attackers to inject and execute arbitrary PHP via {source} blocks. The extension parses {source} tags found anywhere in Joomla's final rendered HTML without reliably verifying where that content originated, so attacker-controlled reflected input reaching the page body gets evaluated as trusted code. Rated CVSS 4.0 10.0 (critical); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Server-Side Request Forgery (SSRF) in Cache Cleaner Pro extension for Joomla 1.0.0-9.7.6 allows unauthenticated remote attackers to access internal or reserved network services via crafted custom query URLs. With a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) the vulnerability is automatable and has total technical impact, though no public exploit or active exploitation has been detected. EPSS predicts a 0.18% likelihood of exploitation in the next 30 days.
Insufficient permission and CSRF token checks in the Modules Anywhere editor popup for Joomla allow authenticated users to view and modify restricted module data without proper authorization. The vulnerability affects all versions up to 8.4.1. No public exploit code or active exploitation is known at this time; the EPSS exploitation probability is low.
Information disclosure in Regular Labs Articles Anywhere and Users Anywhere extensions for Joomla allows unauthenticated remote attackers to view content that should be expired or unpublished. Date-sensitive query caching generates cache keys lacking a bounded time component, so results cached during a valid period persist and can be served after content becomes unavailable. No active exploitation or public proof-of-concept has been identified, and EPSS indicates a low probability of widespread exploitation.
Unauthenticated remote file disclosure in ReReplacer Pro extension for Joomla allows attackers to read arbitrary files outside the site directory via path traversal in XML include paths. The vulnerability affects versions 1.0.0 through 15.0.3 and has a CVSS 3.1 score of 7.5 (high confidentiality impact). No public exploit code or active exploitation has been reported, and EPSS indicates a very low probability of widespread exploitation.
Unauthorized database updates can be triggered via CSRF in the GeoIP extension for Joomla, affecting versions 1.0.0 through 6.3.8. An attacker can trick a logged-in Joomla administrator into submitting a request that performs unauthorized database modifications, potentially compromising all data confidentiality, integrity, and availability. EPSS indicates a low 0.13% exploitation probability, and no active exploitation or public exploit is known at this time.
Exposure of CDN credentials in administrator request URLs in the Cache Cleaner Pro extension for Joomla versions 1.0.0 through
Server-side request forgery in Regular Labs' Articles Anywhere Pro and Users Anywhere Pro extensions for Joomla allows unauthenticated attackers to access internal network services and write arbitrary files to web-accessible directories. The vulnerability stems from improper validation of content-controlled image URLs, which fetch and save remote responses without checking that they are images. No active exploitation or public exploit code has been reported, and EPSS indicates low exploitation probability.
Information disclosure in the GeoIP extension for Joomla 1.0.0 through 6.3.8 exposes MaxMind API credentials directly in request URLs. Unauthenticated remote attackers can intercept these credentials from network traffic or server logs, gaining unauthorized access to the victim’s MaxMind geolocation service. No active exploitation or public exploit code is known, and EPSS probability of exploitation is very low (0.19%).
Unsafe file extraction in the Joomla GeoIP extension (versions 1.0.0-6.3.8) enables remote code execution by writing files outside intended directories during update processing. The vulnerability (CWE-22) does not require authentication and is triggered when the extension extracts untrusted archive files. EPSS probability of exploitation is low (0.20%), and no active exploitation or public exploit is confirmed at this time.
Content tags in the Articles Anywhere and Modules Anywhere extensions for Joomla can ignore access controls, enabling unauthenticated remote attackers to view restricted or unpublished articles and modules. The vulnerability stems from improper authorization enforcement when ignore
Authentication bypass via IP spoofing in the IP Login extension for Joomla allows unauthenticated attackers to impersonate mapped accounts. The extension trusts forwarded client-IP headers without requiring a trusted proxy, enabling remote attackers to spoof the IP used for automatic login. No active exploitation has been confirmed, but the vulnerability is automatable and carries high integrity impact.
We need to produce a JSON object with all fields as plain-text strings. Input: CVE-2026-63265. Description: Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization. CVSS score 8.0, vector: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, CWE-352. EPSS 0.13% (percentile 3%). Reported by: Joomla (probably the vendor). CPE list: many extensions for Joomla. Tags list includes many extension names. SSVC: Exploitation: none, Automatable: no, Technical Impact: total. ENISA EUVD affected versions list for many extensions. References: regularlabs.com and vuldb.com. We must synthesize into a comprehensive analysis. Fields: - product_name: "1-3 words ONLY. The specific product or service name affected." Since it's multiple extensions, but the core issue is Regular Labs extensions for Joomla. I'll pick "Regular Labs Joomla Extensions" (1-3 words, "Regular Labs Joomla Extensions" is 3 words, fine. Could also say "Regular Labs for Joomla" but better to be specific. Description mentions "Privileged Regular Labs AJAX endpoints" so it's across many Regular Labs extensions. So product_name: "Regular Labs Joomla Extensions". This covers the vendor and platform. - summary: 2-3 sentence plain-language. Don't copy description. Original synthesis. Mention what vulnerability, affected product, what attacker can do, if actively exploited, POC, EPSS risk. This is a CSRF vulnerability allowing authenticated lower-privileged users or CSRF attacks to perform unauthorized actions. Starts with impact: "Cross-site request forgery (CSRF) in Regular Labs Joomla extensions allows authenticated lower-privileged users or CSRF attacks to invoke unauthorized AJAX lookups and mutations." Then "Affected extensions (e.g., Advanced Module Manager, Articles Anywhere, etc.) fail to consistent
Database corruption or site takeover in DB Replacer extension for Joomla versions 1.0.0 through 8.2.7 allows unauthorized backend users or CSRF attacks to perform database replacements, risking major data corruption. The vulnerability arises from inconsistent enforcement of Super User permission and CSRF token validation on administrative routes and replacement requests. No public exploit has been identified at time of analysis, and EPSS estimates a low 0.2% probability of exploitation.
We are tasked with generating a JSON analysis for CVE-2026-63280. We have the description, CVSS, CWE, EPSS, SSVC, tags, affected products, references. Need to synthesize all. Let's break down the input: - CVE: CVE-2026-63280 - Description: "Conditions administration did not consistently enforce tokens and component/mapped-item permissions." - CVSS: 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CWE: CWE-352 (Cross-Site Request Forgery) - EPSS: 0.13% (percentile 3%) - Reported by: Joomla - CPE: multiple from regularlabs.com for extensions (Advanced Module Manager, Conditional Content, Content Templater Pro, Rereplacer Pro) for Joomla. - Tags: CSRF, and the extension names. - SSVC: Exploitation: none, Automatable: no, Technical Impact: total - ENISA EUVD-ID: EUVD-2026-47812 - Affected versions from EUVD: listed for each extension. - References: [cveorg] (None) https://regularlabs.com/ ... maybe missing advisory? Only link to vendor homepage. No specific advisory. So patch status unclear. We need to produce a comprehensive analysis. First, product_name: The vulnerability affects multiple extensions from Regular Labs for Joomla. The primary affected product is a set of extensions, but we need to pick a concise name. Could be "Regular Labs Joomla extensions" or the specific one? Since it's multiple, maybe "Advanced Module Manager" or one of them. Description: "Conditions administration did not consistently enforce tokens and component/mapped-item permissions." That sounds like CSRF and permission issues in the admin interface of these extensions. From tags: CSRF. So likely a CSRF vulnerability in all these extensions. The CWE is CWE-352, consistent. Product name: I'll pick "Regular Labs Joomla Extensions" but that might be 3 words. Alternatively, the primary extension mentioned first in tags: "Advanced Module Manager Extension For Joomla" but that's many words. I'll go with "Regular Labs Extensions" (2 words) or "Regular Labs for Joomla"? The instruction
Arbitrary PHP code execution in the Regular Labs Sourcerer extension for Joomla versions 1.0.0 through 12.2.8 allows remote attackers with article editing access to execute arbitrary code on the server. The flaw stems from missing Super User checks in the Free edition and inconsistent permission enforcement across article owners, PHP/CSS/JavaScript settings, tag attributes, and file includes in the Pro edition. No public exploit or active exploitation is confirmed at this time, and the EPSS score indicates low exploitation probability (0.19%), though the CVSS base score is 9.8.
Authentication bypass in Regular Labs Joomla extensions (Advanced Module Manager, Conditional Content, Content Templater Pro, and ReReplacer Pro) allows remote attackers to circumvent IP and GeoIP-based access restrictions by spoofing forwarded headers, effectively granting unauthorized access to location-restricted content or modules. The vulnerability has a CVSS 7.5 (High) with no authentication or user interaction required, but EPSS predicts a very low likelihood of exploitation (0.19%), and no public exploit code or active exploitation has been identified at this time. Affected versions span multiple extensions, and organizations using GeoIP/IP rules should treat this as a moderate risk requiring prompt attention.
Predictable persistent login keys in IP Login extension for Joomla allow unauthenticated attackers to compromise accounts. Versions 1.0.0 through 6.2.5 generate keys using a non-cryptographic random generator with insufficient entropy, enabling brute-force guessing. No public exploit is known, but the low-entropy PRNG makes key prediction feasible.
Information disclosure in multiple Regular Labs Joomla extensions allows unauthenticated visitors to retrieve administrator-only content indexed via Smart Search. Affected extensions include Articles Anywhere, Conditional Content, Modules Anywhere, ReReplacer, Sourcerer, Snippets Pro, and Tabs & Accordions Pro. No public exploit or active exploitation is known, and EPSS probability is low (0.19%).
Insufficient access controls in Regular Labs Extension Manager for Joomla (versions 1.0.0–9.2.5) allow an unauthenticated attacker via CSRF or a low-privilege backend user to install, update, or remove extensions. Successful exploitation can lead to complete site compromise through the installation of a malicious extension. EPSS probability is low (0.13%) and no active exploitation or public exploit code has been identified.
Missing CSRF tokens, item-permission, and input-validation checks in Regular Labs Joomla extensions (Content Templater, ReReplacer, Snippets) allow unauthorized backend users or CSRF attacks to expose, create, or modify extension configuration and items. This high-severity flaw (CVSS 8.8) affects multiple versions, with low exploitation probability (EPSS 0.13%). No active exploitation or public exploit code has been identified.
Reflected cross-site scripting in regularlabs.com's Articles Anywhere (versions before 20.0.0) and Users Anywhere (versions before 2.1.0) extensions for Joomla allows unauthenticated remote attackers to inject executable JavaScript into victims' browsers. The extensions expose a data-tag templating system that pulls values from visitor-controlled request parameters and renders them in output without context-sensitive encoding - Joomla's built-in string input filter does not distinguish between safe-for-HTML-text, safe-for-attribute, and safe-for-URL contexts, so a malicious request value can materialize as an event handler attribute or a javascript: URL wherever a site author has placed a data tag. No public exploit identified at time of analysis.
Database field disclosure in four Regular Labs Joomla extensions - Advanced Module Manager, Conditional Content, Content Templater, and ReReplacer - allows an authenticated high-privilege user to read arbitrary database fields outside the intended scope. The Conditions editor feature accepts user-supplied database table and column names from the HTTP request, which are quoted as SQL identifiers (preventing SQL injection) but are not restricted to the tables and columns supported by Regular Labs integrations. An attacker with administrative access can therefore query unrelated database fields, potentially exposing sensitive Joomla database content such as user records or configuration values. No public exploit code or active exploitation is identified at time of analysis.
Directory enumeration via path traversal in the Modals Pro extension for Joomla 1.0.0–15.0.0 allows unauthenticated remote attackers to list unintended directories. Successful exploitation may expose directory structures and potentially manipulate gallery paths, though only low confidentiality and integrity impacts are reported. EPSS indicates a 0.20% exploitation probability, and no active exploitation or public exploit code is known.
Cross-site request forgery in the Cache Cleaner extension for Joomla allows an authenticated administrator with cache-management permission to be tricked into performing unauthorized URL purges due to inconsistent token validation. Affected versions 1.0.0 through 9.7.6 may experience limited confidentiality and integrity compromise. No public exploit or active exploitation has been identified, and the EPSS score is low (0.13%).
GeoIP rule bypass in Joomla Geo
Path traversal in the Cache Cleaner Pro extension for Joomla allows unauthenticated remote attackers to read and write arbitrary files outside the webroot through
Path traversal in the CDN for Joomla Pro extension for Joomla allows an attacker to check file paths outside the intended site directory via the versioning feature, exposing whether arbitrary files exist and their modification timestamps. The vulnerability has a local attack vector per its CVSS score of 6.2, indicating exploitation likely requires local access or specific configuration, and no active exploitation or public exploit code has been identified.
Cross-site scripting in the Keyboard Shortcuts extension for Joomla (versions 1.0.0-3.2.5) by Regular Labs allows injection of arbitrary JavaScript via the shortcut configuration interface, executing in the browser context of any user who subsequently triggers the affected shortcut. The Changed Scope (S:C) in the CVSS vector confirms script execution crosses into the victim's session context, enabling session hijacking, credential theft, or unauthorized site actions. No public exploit identified at time of analysis; EPSS at 0.21% (11th percentile) and SSVC exploitation status of 'none' both indicate low-probability opportunistic targeting.
Information disclosure in Regular Labs Joomla extensions (Users Anywhere and Articles Anywhere) allows authenticated users to access insufficiently restricted user fields via crafted content containing user tags, filters, or conditions. Attackers with low privileges can expose authentication-related data, raw user parameters, and restricted contact details. No public exploit or active exploitation has been identified at the time of analysis, and the EPSS score (0.23%) indicates low exploitation probability.
Stored cross-site scripting (XSS) in multiple Regular Labs Joomla extensions allows an authenticated content author to inject arbitrary JavaScript. The script executes in visitors' browsers, potentially stealing session tokens or performing actions on their behalf. No active exploitation or public exploit code has been identified; EPSS score indicates very low likelihood of exploitation.
Stored cross-site scripting in Regular Labs Conditional Content and related Joomla extensions enables authenticated administrators to execute