EUVD-2026-87931

Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in clear cache task in Event Gallery extension 6.5.0 - Using the images parameter of the cache.process task, you can recursively delete any directories that the web server is authorized to write to...

CVE-2026-97164 Joomla Extension - svenbluege.de - Path Traversal in Clear Cache task in Event Gallery extension < 6.5.0

Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in clear cache task in Event Gallery extension 6.5.0 - Using the images parameter of the cache.process task, you can recursively delete any directories that the web server is authorized to write to...

EUVD-2026-87930

Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension 6.5.0 - Due to lack of an CSRF token check, a third-party site can upload files to an event and overwrite existing files with the same name...

CVE-2026-100747 Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0

Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension 6.5.0 - Due to lack of an CSRF token check, a third-party site can upload files to an event and overwrite existing files with the same name...

CVE-2026-100747

The Joomla Extension - svenbluege.de - Event Gallery extension (versions

CVE-2026-100747 Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0

Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension 6.5.0 - Due to lack of an CSRF token check, a third-party site can upload files to an event and overwrite existing files with the same name...

CVE-2026-100749 Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0

Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension 6.5.0 - Only orphaned file entries and shopping carts that are older than 30 days will be deleted...

CVE-2026-100749

The Event Gallery extension for Joomla (versions

CVE-2026-100749 Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0

Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension 6.5.0 - Only orphaned file entries and shopping carts that are older than 30 days will be deleted...

EUVD-2026-87929

Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension 6.5.0 - Only orphaned file entries and shopping carts that are older than 30 days will be deleted...

CVE-2026-97165

The Joomla Extension - svenbluege.de - Event Gallery extension versions prior to 6.5.0 is vulnerable to Reflected XSS and open redirect . The root cause is that the "return" parameter is base64-decoded and written directly to the "Back" link without sufficient validation. This could allow an atta...

CVE-2026-97165 Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0

Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension 6.5.0 - The “return” parameter is base64-decoded and written to the “Back” link without being validated...

EUVD-2026-87928

Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension 6.5.0 - The “return” parameter is base64-decoded and written to the “Back” link without being validated...

CVE-2026-97165 Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0

Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension 6.5.0 - The “return” parameter is base64-decoded and written to the “Back” link without being validated...

CVE-2026-100741 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer

Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with the privileges of the service account, via a...

CVE-2026-97164: Improper Limitation of a Pathname to a Restricted Directory

Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in clear cache task in Event Gallery extension 6.5.0 - Using the images parameter of the cache.process task, you can recursively delete any directories that the web server is authorized to write to...

PT-2026-99533

Name of the Vulnerable Software and Affected Versions Event Gallery versions prior to 6.5.0 Description A Cross-Site Request Forgery CSRF issue exists in the backend cleanup actions. This allows an attacker to trigger the deletion of orphaned file entries and shopping carts that are older than 30...

CVE-2026-100741: Improper Neutralization of Directives in Dynamically Evaluated Code

Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with the privileges of the service account, via a...

CVE-2026-97165: URL Redirection to Untrusted Site

Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension 6.5.0 - The “return” parameter is base64-decoded and written to the “Back” link without being validated...

PT-2026-99535

Name of the Vulnerable Software and Affected Versions Event Gallery versions prior to 6.5.0 Description A reflected Cross-Site Scripting XSS and open redirect issue exists. The return parameter is base64-decoded and written to the Back link without proper validation. Recommendations Update to...