Zoo Extension For Joomla
Monthly
Stored cross-site scripting in Zoo Extension for Joomla (all versions before 4.1.66) allows unauthenticated remote attackers to inject persistent JavaScript payloads through comment fields and user-supplied field elements. Because these inputs were not escaped before being rendered, any user or administrator who subsequently views the affected content triggers execution of the attacker's script in their browser context, enabling session hijacking, credential theft, or privilege escalation to administrator level. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated arbitrary directory listing in the Gallery element of the YOOtheme Zoo extension for Joomla exposes server-side directory structures to any remote, unauthenticated attacker on sites running Zoo versions prior to 4.1.66. The path traversal vulnerability (CWE-22) allows crafted requests to enumerate directories outside the intended scope of the Gallery element, potentially revealing sensitive filesystem layout including configuration paths, user data directories, or other installed components. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Reflected XSS and open redirect in yootheme.com's Zoo extension for Joomla (versions prior to 4.1.66) allow remote attackers to inject arbitrary JavaScript into a victim's browser session or redirect users to attacker-controlled URLs by crafting a malicious link containing an unsanitized submission redirect parameter. Exploitation requires a user to follow the crafted link, limiting automated mass exploitation. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis.
Unauthenticated arbitrary file upload in the YOOtheme Zoo content-builder extension for Joomla (versions before 4.1.64) allows remote attackers to upload arbitrary files, including web shells, because the image element only validates the client-supplied Content-Type header against the image MIME group rather than the actual file contents or extension. Rated CVSS 4.0 base 10.0 with full confidentiality, integrity, and availability impact plus scope change, this is a critical pre-authentication flaw. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Open redirect in YOOtheme Zoo extension for Joomla (versions prior to 4.1.64) allows unauthenticated network attackers to redirect authenticated users to arbitrary external URLs. The vulnerability exists in CommentController::twitterAuthenticate(), where the referer request parameter is forwarded without validation directly to setRedirect(). No public exploit code has been identified at time of analysis, and no active exploitation is confirmed via CISA KEV.
SQL injection in the YOOtheme Zoo content-construction extension for Joomla allows unauthenticated remote attackers to inject arbitrary SQL through the filter_type and type_filter request parameters, which are concatenated directly into a.type comparison clauses in ItemController::element() without quoting or escaping. All Zoo versions before 4.1.64 are affected, and because no authentication or user interaction is required, an attacker can read or manipulate the Joomla database over the network. No public exploit has been identified at time of analysis, but the trivial exploitation profile (CVSS 9.3) makes weaponization straightforward.
Stored cross-site scripting in Zoo Extension for Joomla (all versions before 4.1.66) allows unauthenticated remote attackers to inject persistent JavaScript payloads through comment fields and user-supplied field elements. Because these inputs were not escaped before being rendered, any user or administrator who subsequently views the affected content triggers execution of the attacker's script in their browser context, enabling session hijacking, credential theft, or privilege escalation to administrator level. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated arbitrary directory listing in the Gallery element of the YOOtheme Zoo extension for Joomla exposes server-side directory structures to any remote, unauthenticated attacker on sites running Zoo versions prior to 4.1.66. The path traversal vulnerability (CWE-22) allows crafted requests to enumerate directories outside the intended scope of the Gallery element, potentially revealing sensitive filesystem layout including configuration paths, user data directories, or other installed components. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Reflected XSS and open redirect in yootheme.com's Zoo extension for Joomla (versions prior to 4.1.66) allow remote attackers to inject arbitrary JavaScript into a victim's browser session or redirect users to attacker-controlled URLs by crafting a malicious link containing an unsanitized submission redirect parameter. Exploitation requires a user to follow the crafted link, limiting automated mass exploitation. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis.
Unauthenticated arbitrary file upload in the YOOtheme Zoo content-builder extension for Joomla (versions before 4.1.64) allows remote attackers to upload arbitrary files, including web shells, because the image element only validates the client-supplied Content-Type header against the image MIME group rather than the actual file contents or extension. Rated CVSS 4.0 base 10.0 with full confidentiality, integrity, and availability impact plus scope change, this is a critical pre-authentication flaw. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Open redirect in YOOtheme Zoo extension for Joomla (versions prior to 4.1.64) allows unauthenticated network attackers to redirect authenticated users to arbitrary external URLs. The vulnerability exists in CommentController::twitterAuthenticate(), where the referer request parameter is forwarded without validation directly to setRedirect(). No public exploit code has been identified at time of analysis, and no active exploitation is confirmed via CISA KEV.
SQL injection in the YOOtheme Zoo content-construction extension for Joomla allows unauthenticated remote attackers to inject arbitrary SQL through the filter_type and type_filter request parameters, which are concatenated directly into a.type comparison clauses in ItemController::element() without quoting or escaping. All Zoo versions before 4.1.64 are affected, and because no authentication or user interaction is required, an attacker can read or manipulate the Joomla database over the network. No public exploit has been identified at time of analysis, but the trivial exploitation profile (CVSS 9.3) makes weaponization straightforward.