CVE-2026-90902

Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update task administrator/index.php?option=comeasystore&task=coupon.couponBulkUpdate took input IDs and directly concatenated them into raw SQL I...

CVE-2026-90902

The Joomla Extension - joomshaper.com - Easy Store (versions 1.0.0-3.0.0 ) is vulnerable to an Authenticated, Privileged SQL Injection within the coupon bulk update task. The flaw exists because input IDs in ProductCoupon.php and CouponsModel.php are directly concatenated into raw SQL IN (...) cl...

EUVD-2026-85552

Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update task administrator/index.php?option=comeasystore&task=coupon.couponBulkUpdate took input IDs and directly concatenated them into raw SQL I...

CVE-2026-90902 Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0

Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update task administrator/index.php?option=comeasystore&task=coupon.couponBulkUpdate took input IDs and directly concatenated them into raw SQL I...

CVE-2026-90902 Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0

Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update task administrator/index.php?option=comeasystore&task=coupon.couponBulkUpdate took input IDs and directly concatenated them into raw SQL I...

PT-2026-97514

Name of the Vulnerable Software and Affected Versions Easy Store versions 1.0.0 through 3.0.0 Description An authenticated administrator can perform a SQL Injection through the coupon bulk update task. The issue occurs because the application takes input IDs and directly concatenates them into ra...

CVE-2026-90902: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update task administrator/index.php?option=comeasystore&task=coupon.couponBulkUpdate took input IDs and directly concatenated them into raw SQL I...