31034 matches found
EUVD-2026-63940
Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector...
CVE-2026-76612 Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66
Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector...
CVE-2026-77029
Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo 4.1.66...
CVE-2026-76611
Zoo is a Joomla extension developed by yootheme.com . The Gallery element in Zoo versions prior to 4.1.66 is vulnerable to unauthenticated arbitrary directory listing , allowing a remote attacker over the network to list directory contents without any authentication or user interaction. The CVSS ...
CVE-2026-76611 Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66
Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo 4.1.66...
CVE-2026-76611 Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66
Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo 4.1.66...
CVE-2026-75115 Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40
Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files...
CVE-2026-75115 Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40
Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files...
CVE-2026-75115
YOOtheme Pro (a Joomla extension by yootheme.com) versions 2.3.0 through 5.0.40 are affected by an authenticated arbitrary file read vulnerability. The root cause is that the Filesystem source's path filter is vulnerable to glob-based pattern attacks , allowing authorized users with privileged ac...
EUVD-2026-63938
Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files...
CVE-2026-76613 Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40
Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries...
EUVD-2026-63937
Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries...
CVE-2026-76613 Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40
Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries...
CVE-2026-76613
YOOtheme Pro (a Joomla extension by yootheme.com) versions 1.0.0 through 5.0.40 are affected by an authenticated, privileged SQL injection vulnerability. Any user with contributor-level access can inject arbitrary content into SQL queries, resulting in high impact on the confidentiality, integrit...
CVE-2026-77028
Zoo is a Joomla extension developed by yootheme.com. Versions prior to 4.1.66 are affected by a reflected XSS and open redirect vulnerability through the submission redirect parameter . The CVSS 4.0 base score is 5.3 (MEDIUM) , with low impact on confidentiality, integrity, and availability of th...
EUVD-2026-63936
Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo 4.1.66...
CVE-2026-77028 Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66
Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo 4.1.66...
CVE-2026-77028 Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66
Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo 4.1.66...
CVE-2026-77029
Zoo , a Joomla extension by yootheme.com , is affected by a missing CSRF token vulnerability on front-end state changes in versions prior to 4.1.66 . The CVSS 4.0 base score is 4.6 (MEDIUM) , with high privileges and active user interaction required, resulting in low integrity impact . No exploit...