Stageit Extension For Joomla
Monthly
The StageIt extension for Joomla (published by php-web-design.com) performs state-changing actions without adequate cross-site request forgery protection, so an attacker who can lure a logged-in Joomla user or administrator to a malicious page or crafted link can cause those actions to be executed with the victim's privileges. Versions 1.0 through 5.7.5 and 6.0 through 6.3.5 are affected, and the impact is rated high for both integrity and availability (CVSS 4.0 base 7.2; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H), with no confidentiality impact. Exploitation requires an authenticated victim session and user interaction, the attacker needs no credentials, and no public exploit code or confirmed active exploitation is identified in the available sources; priority is triaged as remediation this week.
Code injection (CWE-94) in the StageIt extension for Joomla, published by php-web-design.com, allows an attacker who already holds high-privilege access to the Joomla administrator back end to have attacker-controlled configuration 'setting string' values interpreted as code, yielding high impact to confidentiality, integrity and availability (CVSS 8.6; CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). Affected builds are StageIt 1.0 through 5.7.5 and 6.0 through 6.3.5; sites on other versions are out of scope. The flaw is not reachable by an unauthenticated remote user and requires no victim interaction once administrative access exists - the dominant limiting factor is the PR:H privilege prerequisite, and no public exploit code or CISA KEV entry is associated with this CVE at time of analysis (priority label: this_week).
Reflected cross-site scripting in the StageIt extension for Joomla (php-web-design.com) affects versions 1.0 through 5.7.5 and 6.0 through 6.3.5, allowing an unauthenticated remote attacker to have script execute in a victim's browser when the victim loads a crafted URL; the issue is rated CVSS 5.3 (moderate). Exploitation requires user interaction (UI:P) and impact is limited to the victim's browser session, and no public exploit or CISA KEV entry is identified at time of analysis; the vuln.today decision label is this_month.
The StageIt extension for Joomla (published by php-web-design.com) performs state-changing actions without adequate cross-site request forgery protection, so an attacker who can lure a logged-in Joomla user or administrator to a malicious page or crafted link can cause those actions to be executed with the victim's privileges. Versions 1.0 through 5.7.5 and 6.0 through 6.3.5 are affected, and the impact is rated high for both integrity and availability (CVSS 4.0 base 7.2; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H), with no confidentiality impact. Exploitation requires an authenticated victim session and user interaction, the attacker needs no credentials, and no public exploit code or confirmed active exploitation is identified in the available sources; priority is triaged as remediation this week.
Code injection (CWE-94) in the StageIt extension for Joomla, published by php-web-design.com, allows an attacker who already holds high-privilege access to the Joomla administrator back end to have attacker-controlled configuration 'setting string' values interpreted as code, yielding high impact to confidentiality, integrity and availability (CVSS 8.6; CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). Affected builds are StageIt 1.0 through 5.7.5 and 6.0 through 6.3.5; sites on other versions are out of scope. The flaw is not reachable by an unauthenticated remote user and requires no victim interaction once administrative access exists - the dominant limiting factor is the PR:H privilege prerequisite, and no public exploit code or CISA KEV entry is associated with this CVE at time of analysis (priority label: this_week).
Reflected cross-site scripting in the StageIt extension for Joomla (php-web-design.com) affects versions 1.0 through 5.7.5 and 6.0 through 6.3.5, allowing an unauthenticated remote attacker to have script execute in a victim's browser when the victim loads a crafted URL; the issue is rated CVSS 5.3 (moderate). Exploitation requires user interaction (UI:P) and impact is limited to the victim's browser session, and no public exploit or CISA KEV entry is identified at time of analysis; the vuln.today decision label is this_month.