Ro Csvi
Monthly
Cross-site scripting vulnerabilities in RO CSVI's AJAX endpoint handlers allow unauthenticated remote attackers to inject malicious scripts into the browsers of Joomla site users. All versions from 1.0.0 up to (but not including) 9.11.0 are affected. No public exploit code or active exploitation has been identified at time of analysis, though the CVSS scope-changed vector (S:C) and absence of authentication requirement make this an accessible attack for opportunistic threat actors targeting Joomla deployments running the extension.
Cross-site request forgery in the RO CSVI (CSV Improved) import/export extension for Joomla by rolandd.com affects all versions from 1.0.0 up to but not including 9.11.0, allowing an attacker to forge requests to the extension's AJAX endpoint handlers. By tricking an authenticated administrator into visiting a malicious page, an attacker can trigger state-changing operations on the victim's behalf, with the CVSS 8.8 vector indicating high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the very low EPSS score (0.10%, 1st percentile) suggests exploitation is not currently widespread.
Unauthenticated directory creation in the RO CSVI (CSV Improved) import/export extension for Joomla affects all versions from 1.0.0 through 9.11.0, allowing remote attackers with no authentication to create arbitrary directories on the server. The flaw is an access-control failure (CWE-284) tagged by the reporter as an authentication bypass, carrying a CVSS 7.5. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Cross-site scripting vulnerabilities in RO CSVI's AJAX endpoint handlers allow unauthenticated remote attackers to inject malicious scripts into the browsers of Joomla site users. All versions from 1.0.0 up to (but not including) 9.11.0 are affected. No public exploit code or active exploitation has been identified at time of analysis, though the CVSS scope-changed vector (S:C) and absence of authentication requirement make this an accessible attack for opportunistic threat actors targeting Joomla deployments running the extension.
Cross-site request forgery in the RO CSVI (CSV Improved) import/export extension for Joomla by rolandd.com affects all versions from 1.0.0 up to but not including 9.11.0, allowing an attacker to forge requests to the extension's AJAX endpoint handlers. By tricking an authenticated administrator into visiting a malicious page, an attacker can trigger state-changing operations on the victim's behalf, with the CVSS 8.8 vector indicating high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the very low EPSS score (0.10%, 1st percentile) suggests exploitation is not currently widespread.
Unauthenticated directory creation in the RO CSVI (CSV Improved) import/export extension for Joomla affects all versions from 1.0.0 through 9.11.0, allowing remote attackers with no authentication to create arbitrary directories on the server. The flaw is an access-control failure (CWE-284) tagged by the reporter as an authentication bypass, carrying a CVSS 7.5. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.