Sourcerer Extension For Joomla
Monthly
Remote code execution in Regular Labs Sourcerer for Joomla (versions before 14.0.0) allows unauthenticated attackers to inject and execute arbitrary PHP via {source} blocks. The extension parses {source} tags found anywhere in Joomla's final rendered HTML without reliably verifying where that content originated, so attacker-controlled reflected input reaching the page body gets evaluated as trusted code. Rated CVSS 4.0 10.0 (critical); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Broken CSRF token enforcement across 23 Regular Labs AJAX-based Joomla extensions allows authenticated lower-privileged users to directly invoke privileged endpoints, or allows any attacker to perform those operations via a cross-site request forgery attack against an authenticated victim. The affected surface spans virtually the entire Regular Labs extension portfolio, from Advanced Module Manager through Sourcerer, covering all versions from 1.0.0 up to per-extension maximums. No public exploit or active exploitation has been confirmed; EPSS is 0.13%, consistent with the UI:R requirement that prevents mass automated attack.
Arbitrary PHP code execution in the Regular Labs Sourcerer extension for Joomla versions 1.0.0 through 12.2.8 allows remote attackers with article editing access to execute arbitrary code on the server. The flaw stems from missing Super User checks in the Free edition and inconsistent permission enforcement across article owners, PHP/CSS/JavaScript settings, tag attributes, and file includes in the Pro edition. No public exploit or active exploitation is confirmed at this time, and the EPSS score indicates low exploitation probability (0.19%), though the CVSS base score is 9.8.
Information disclosure in multiple Regular Labs Joomla extensions allows unauthenticated visitors to retrieve administrator-only content indexed via Smart Search. Affected extensions include Articles Anywhere, Conditional Content, Modules Anywhere, ReReplacer, Sourcerer, Snippets Pro, and Tabs & Accordions Pro. No public exploit or active exploitation is known, and EPSS probability is low (0.19%).
Remote code execution in Regular Labs Sourcerer for Joomla (versions before 14.0.0) allows unauthenticated attackers to inject and execute arbitrary PHP via {source} blocks. The extension parses {source} tags found anywhere in Joomla's final rendered HTML without reliably verifying where that content originated, so attacker-controlled reflected input reaching the page body gets evaluated as trusted code. Rated CVSS 4.0 10.0 (critical); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Broken CSRF token enforcement across 23 Regular Labs AJAX-based Joomla extensions allows authenticated lower-privileged users to directly invoke privileged endpoints, or allows any attacker to perform those operations via a cross-site request forgery attack against an authenticated victim. The affected surface spans virtually the entire Regular Labs extension portfolio, from Advanced Module Manager through Sourcerer, covering all versions from 1.0.0 up to per-extension maximums. No public exploit or active exploitation has been confirmed; EPSS is 0.13%, consistent with the UI:R requirement that prevents mass automated attack.
Arbitrary PHP code execution in the Regular Labs Sourcerer extension for Joomla versions 1.0.0 through 12.2.8 allows remote attackers with article editing access to execute arbitrary code on the server. The flaw stems from missing Super User checks in the Free edition and inconsistent permission enforcement across article owners, PHP/CSS/JavaScript settings, tag attributes, and file includes in the Pro edition. No public exploit or active exploitation is confirmed at this time, and the EPSS score indicates low exploitation probability (0.19%), though the CVSS base score is 9.8.
Information disclosure in multiple Regular Labs Joomla extensions allows unauthenticated visitors to retrieve administrator-only content indexed via Smart Search. Affected extensions include Articles Anywhere, Conditional Content, Modules Anywhere, ReReplacer, Sourcerer, Snippets Pro, and Tabs & Accordions Pro. No public exploit or active exploitation is known, and EPSS probability is low (0.19%).