EUVD-2026-62501

Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory 6.2.3 - Tokens were missing on many AJAX/state-changing tasks: contact/quote forms, cart, bookmarks, uploads, messages, AI text generation, and several administrator actions app install, demo-data wipe,...

EUVD-2026-62498

Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory 6.2.3 - Recipient address was taken from the request contactidoffer / contactidevent instead of the server-side offer/event record, so mail could be sent to an arbitrary address...

EUVD-2026-62496

Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory 6.2.3 - companyName from the request was written unescaped into an XML attribute...

EUVD-2026-62492

Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference multiple frontend/API actions in J-BusinessDirectory 6.2.3...

EUVD-2026-62491

Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory 6.2.3 - Pagination values were not strictly typed. Array/non-numeric values for example limitstart could trigger PHP type errors in arithmetic, and limit was not validated before use in list...

EUVD-2026-62490

Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory 6.2.3 - Search keywords and ORDER BY were concatenated into SQL. 6.2.3 quotes keywords and allow-lists the sort clause...

EUVD-2026-62489

Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion path traversal in J-BusinessDirectory 6.2.3 - Upload/remove accepted a client-controlled root pathtype could point at the component site/admin trees, did not enforce path containment, and used a weak extension check. CSRF token w...

EUVD-2026-62488

Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory 6.2.3 - Ownership could be changed using attacker-supplied company and user IDs, including for listings that already had an owner. 6.2.3 binds the action to the authenticated user and only allows...

EUVD-2020-26429

Malware in sbrugna...

CVE-2020-5182

The J-BusinessDirectory extension before 5.2.9 for Joomla! allows Reverse Tabnabbing. In some configurations, the link to the business website can be entered by any user. If it doesn't contain rel="noopener" or similar attributes such as noreferrer, the tabnabbing may occur. To reproduce the bug,...

J-BusinessDirectory, 5.7.7 and prior, Other

In the J-BusinessDirectory version 5.8.3 we have updated guzzlehttp to the latest version, 7.5.0 and to PSR 2.1.5...

CVE-2020-5182

The J-BusinessDirectory extension before 5.2.9 for Joomla! allows Reverse Tabnabbing. In some configurations, the link to the business website can be entered by any user. If it doesn't contain rel="noopener" or similar attributes such as noreferrer, the tabnabbing may occur. To reproduce the bug,...

Design/Logic Flaw

The J-BusinessDirectory extension before 5.2.9 for Joomla! allows Reverse Tabnabbing. In some configurations, the link to the business website can be entered by any user. If it doesn't contain rel="noopener" or similar attributes such as noreferrer, the tabnabbing may occur. To reproduce the bug,...

CVE-2020-5182

The CVE-2020-5182 vulnerability affects the J-BusinessDirectory extension for Joomla! versions before 5.2.9. It enables Reverse Tabnabbing when a link to a business website is entered without rel="noopener" (or equivalent like noreferrer); a crafted link can exploit window.opener to redirect the ...

CVE-2020-5182

The J-BusinessDirectory extension before 5.2.9 for Joomla! allows Reverse Tabnabbing. In some configurations, the link to the business website can be entered by any user. If it doesn't contain rel="noopener" or similar attributes such as noreferrer, the tabnabbing may occur. To reproduce the bug,...

Joomla! J-BusinessDirectory 4.9.7 SQL Injection

Exploit Title: Joomla! Component J-BusinessDirectory 4.9.7 - SQL Injection Dork: N/A Date: 2019-01-23 Exploit Author: Ihsan Sencan Vendor Homepage: http://cmsjunkie.com/ Software Link: https://extensions.joomla.org/extensions/extension/directory-a-documentation/directory/j-businessdirectory/...

Joomla J-BusinessDirectory 4.9.7 Component - type SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component J-BusinessDirectory 4.9.7 - SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: http://cmsjunkie.com/ Software Link:...

Joomla! Component J-BusinessDirectory 4.9.7 - type SQL Injection

Joomla! Component J-BusinessDirectory 4.9.7 - type SQL Injection Exploit Title: Joomla! Component J-BusinessDirectory 4.9.7 - SQL Injection Dork: N/A Date: 2019-01-23 Exploit Author: Ihsan Sencan Vendor Homepage: http://cmsjunkie.com/ Software Link:...

Joomla! Component J-BusinessDirectory 4.9.7 - 'type' SQL Injection

Exploit Title: Joomla! Component J-BusinessDirectory 4.9.7 - SQL Injection Dork: N/A Date: 2019-01-23 Exploit Author: Ihsan Sencan Vendor Homepage: http://cmsjunkie.com/ Software Link: https://extensions.joomla.org/extensions/extension/directory-a-documentation/directory/j-businessdirectory/...

Joomla J-BusinessDirectory 4.7.3 SQL Injection Vulnerability

Exploit for php platform in category web applications Title: Joomla J-BusinessDirectory 4.7.3 -SQL injection Credit: Bilal KARDADOU Vendor: http://www.cmsjunkie.com/j-business-directory URL: https://extensions.joomla.org/extensions/extension/directory-a-documentation/directory/j-businessdirectory...