8581 matches found
CVE-2026-90901
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion endpoint administrator/index.php?option=comeasystore&task=media.deleteImage parsed the ids parameter as a comma-separated string and implode...
EUVD-2026-85558
Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 - The administrator ApiController only validated CSRF tokens inside the products action. All other administrative AJAX endpoints orders, coupons, media,...
CVE-2026-90903
The Joomla Extension - joomshaper.com 's Easy Store extension (versions 1.0.0-3.0.0 ) contains a vulnerability where the ApiController fails to verify CSRF tokens across most administrator AJAX API endpoints. While the products() action was protected, other endpoints—including orders, coupons, me...
CVE-2026-90901 Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion endpoint administrator/index.php?option=comeasystore&task=media.deleteImage parsed the ids parameter as a comma-separated string and implode...
CVE-2026-90901 Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion endpoint administrator/index.php?option=comeasystore&task=media.deleteImage parsed the ids parameter as a comma-separated string and implode...
CVE-2026-90901
The Easy Store extension (versions 1.0.0-3.0.0 ) for Joomla by joomshaper.com is vulnerable to an SQL Injection due to the lack of authentication, session validation, or ownership checks on the checkout.searchGuestUser endpoint. An unauthenticated attacker can provide an email address to query th...
EUVD-2026-85557
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping detai...
EUVD-2026-85556
Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=comeasystore&task=appconfig.updateConfiguration updated core Joomla mail configuration fromname, mailfrom in...
CVE-2026-90905
The Easy Store Joomla extension (versions 1.0.0-3.0.0 ) by joomshaper.com is vulnerable to a Cross-Site Request Forgery (CSRF) and a lack of Access Control on the administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration endpoint. The root cause is the failure to verify anti...
CVE-2026-90902 Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update task administrator/index.php?option=comeasystore&task=coupon.couponBulkUpdate took input IDs and directly concatenated them into raw SQL I...
CVE-2026-90902
The Joomla Extension - joomshaper.com - Easy Store (versions 1.0.0-3.0.0 ) is vulnerable to an Authenticated, Privileged SQL Injection within the coupon bulk update task. The flaw exists because input IDs in ProductCoupon.php and CouponsModel.php are directly concatenated into raw SQL IN (...) cl...
CVE-2026-90902 Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update task administrator/index.php?option=comeasystore&task=coupon.couponBulkUpdate took input IDs and directly concatenated them into raw SQL I...
EUVD-2026-85552
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update task administrator/index.php?option=comeasystore&task=coupon.couponBulkUpdate took input IDs and directly concatenated them into raw SQL I...
EUVD-2026-85550
Joomla Extension - joomshaper.com - Broken Access Control ACL Bypass in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit method in ApiController.php hardcoded return true;, bypassing Joomla component-level and asset-level ACL permission checks. Any authenticated...
CVE-2026-90904
The Easy Store extension (versions 1.0.0-3.0.0 ) by joomshaper.com contains a Broken Access Control vulnerability. The allowEdit() method in ApiController.php hardcodes a return true; statement, which bypasses Joomla's component-level and asset-level ACL permission checks . This allows any authen...
EUVD-2026-85549
Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping details full...
CVE-2026-90899
The Easy Store extension (versions 1.0.0-3.0.0 ) for Joomla by joomshaper.com contains an Insecure Direct Object Reference (IDOR) vulnerability. The checkout.searchGuestUser endpoint allows unauthenticated attackers to query guest checkout records using only an email address. Because the server l...
CVE-2026-90900
Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product review submission endpoint index.php?option=comeasystore&task=product.addReview accepted submissions without verifying an anti-CSRF token t...
EUVD-2026-85546
Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product review submission endpoint index.php?option=comeasystore&task=product.addReview accepted submissions without verifying an anti-CSRF token t...