Up Plugin For Joomla
Monthly
Unauthenticated path traversal in the lomart.fr UP extension for Joomla (versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29) allows remote attackers to read files outside the intended plugin directory, exposing configuration files, credentials and other sensitive data under the web root's readable filesystem. The reported CVSS 4.0 score is 9.2, and the independently assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms a confidentiality-only impact with no authentication or user interaction required, while integrity and availability remain unaffected. Real-world risk is governed by deployment scope rather than exploitability: this is a niche third-party Joomla extension, no public exploit was identified at time of analysis, and only sites that have the plugin installed and enabled at an affected version are exposed.
Unauthenticated remote code installation in the lomart.fr 'UP' plugin for Joomla (versions 5.0.0-5.2.0 and 6.0.0-6.0.29) allows remote attackers to write and install arbitrary code on affected sites without authentication, user interaction, or non-default configuration, as reflected in the vendor's CVSS 4.0 base score of 10.0. The flaw is a path traversal (CWE-22) that lets attacker-supplied paths escape the intended directory and place executable content where the web server will run it, giving full compromise of confidentiality, integrity, and availability on the host and follow-on systems. This is a niche, single-vendor Joomla add-on, so exposure depends entirely on whether the plugin is installed and active; no public exploit has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing).
Unauthenticated SQL injection exists in the lomart.fr UP Plugin for Joomla at versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29, letting remote attackers reach the plugin's vulnerable request handlers and inject arbitrary SQL into backend database queries; the vendor-assigned CVSS 4.0 vector (8.3, AV:N/AC:L/AT:P/PR:N/UI:N) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) both describe a network-reachable, no-authentication, no-user-interaction flaw capable of returning or altering stored data. Only Joomla sites that actually have this third-party extension installed and expose the affected endpoint are in scope, and the plugin's comparatively small install base limits the overall attack surface; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV). Successful exploitation depends on the injectable feature being reachable in the target deployment, which is why the CVSS 4.0 vector carries the AT:P attack-requirement flag.
Authenticated PHP code injection in the lomart.fr UP Plugin for Joomla (versions 5.0.0-5.2.0 and 6.0.0-6.0.29) allows a high-privilege administrator to execute arbitrary PHP code and system commands on the underlying server. The flaw requires a valid Joomla administrator account (PR:H) and is remotely exploitable without user interaction, but no public exploit code or active exploitation has been identified at time of analysis. Because the plugin is a narrowly deployed third-party extension and no vendor patch is available, the real-world priority is low despite the critical CVSS score (9.4), with mitigation limited to removing the plugin or tightly restricting administrative access.
Unauthenticated path traversal in the lomart.fr UP extension for Joomla (versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29) allows remote attackers to read files outside the intended plugin directory, exposing configuration files, credentials and other sensitive data under the web root's readable filesystem. The reported CVSS 4.0 score is 9.2, and the independently assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms a confidentiality-only impact with no authentication or user interaction required, while integrity and availability remain unaffected. Real-world risk is governed by deployment scope rather than exploitability: this is a niche third-party Joomla extension, no public exploit was identified at time of analysis, and only sites that have the plugin installed and enabled at an affected version are exposed.
Unauthenticated remote code installation in the lomart.fr 'UP' plugin for Joomla (versions 5.0.0-5.2.0 and 6.0.0-6.0.29) allows remote attackers to write and install arbitrary code on affected sites without authentication, user interaction, or non-default configuration, as reflected in the vendor's CVSS 4.0 base score of 10.0. The flaw is a path traversal (CWE-22) that lets attacker-supplied paths escape the intended directory and place executable content where the web server will run it, giving full compromise of confidentiality, integrity, and availability on the host and follow-on systems. This is a niche, single-vendor Joomla add-on, so exposure depends entirely on whether the plugin is installed and active; no public exploit has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing).
Unauthenticated SQL injection exists in the lomart.fr UP Plugin for Joomla at versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29, letting remote attackers reach the plugin's vulnerable request handlers and inject arbitrary SQL into backend database queries; the vendor-assigned CVSS 4.0 vector (8.3, AV:N/AC:L/AT:P/PR:N/UI:N) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) both describe a network-reachable, no-authentication, no-user-interaction flaw capable of returning or altering stored data. Only Joomla sites that actually have this third-party extension installed and expose the affected endpoint are in scope, and the plugin's comparatively small install base limits the overall attack surface; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV). Successful exploitation depends on the injectable feature being reachable in the target deployment, which is why the CVSS 4.0 vector carries the AT:P attack-requirement flag.
Authenticated PHP code injection in the lomart.fr UP Plugin for Joomla (versions 5.0.0-5.2.0 and 6.0.0-6.0.29) allows a high-privilege administrator to execute arbitrary PHP code and system commands on the underlying server. The flaw requires a valid Joomla administrator account (PR:H) and is remotely exploitable without user interaction, but no public exploit code or active exploitation has been identified at time of analysis. Because the plugin is a narrowly deployed third-party extension and no vendor patch is available, the real-world priority is low despite the critical CVSS score (9.4), with mitigation limited to removing the plugin or tightly restricting administrative access.