CVE-2023-27842

CVE-2023-27842 eXtplorer 2.1.15 – Permissões inseguras após execução remota de código Autenticado Página do fornecedor: http://extplorer.net/ Link do software: http://extplorer.net/attachments/download/99/eXtplorer2.1.15.zip Versão: 2.1.15 Instalação root@kitploit: git clone...

CVE-2026-65761

CVE-2026-65761 - Prova de conceito de injeção de SQL no EasyStore Pro via filtersortby Este repositório fornece uma prova de conceito educacional para CVE-2026-65761, uma vulnerabilidade de injeção de SQL não autenticada que afeta as versões 1.0.0 a 2.0.2 inclusive da extensão EasyStore para...

CVE-2026-77998

Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO 11.0.2, SAML SP Single Sign On – Login with ADFS 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps 6.4 - This is due to the mosamlvalidatesignature function...

CVE-2026-77998 Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4

Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO 11.0.2, SAML SP Single Sign On – Login with ADFS 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps 6.4 - This is due to the mosamlvalidatesignature function...

CVE-2026-77997

Joomla Extension - yootheme.com - Authenticated, privileged information disclosure in YOOtheme Pro 1.0.0-5.0.41 - A missing access check allowed users with comtemplate editing permissions to access information about arbitrary modules without the respective commodules permissions...

CVE-2026-77996

Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector...

CVE-2026-77997

YOOtheme Pro (a Joomla extension by yootheme.com) versions 1.0.0 through 5.0.41 contain a missing access check that allows authenticated users holding com_template editing permissions to view information about arbitrary site modules without the corresponding com_modules permissions. This constitu...

CVE-2026-77996 Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41

Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector...

CVE-2026-77996

YOOtheme Pro (a Joomla extension) is affected by an authenticated, privileged stored XSS in versions 1.0.0 through 5.0.41 . The root cause is a lack of escaping in the location custom field , which allows a privileged user to inject a cross-site scripting payload. The CVSS 4.0 base score is 7.5 (...

EUVD-2026-65477

Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector...

CVE-2026-77996 Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41

Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector...

CVE-2019-15120

CVE-2019-15120 Exploit für XSS via BBCode in der Kunena-Erweiterung vor Version 5.1.14 für Joomla! Informationen Beschreibung: In der Kunena-Erweiterung vor Version 5.1.14 für Joomla! ist es möglich, dass jeder Benutzer einen gespeicherten XSS-Angriff ausführt, indem er eine spezielle Nachricht i...

CVE-2024-5737

CVE-2024-5737 AdmirorFrames Joomla! एक्सटेंशन HTML टैग पर सेट हैं: root@kitploit: $height=0x3c; $im = imagecreate$width, $height; $hex=unpack'H',$payload; $chunks=strsplit$hex1, 6; for$i=0; $i count$chunks; $i++ $colorchunks=strsplit$chunks$i, 2;...

CVE-2024-5736

CVE-2024-5736 إضافة AdmirorFrames لـ Joomla! 5.0 - تزوير الطلبات من جانب الخادم SSRF الجدول الزمني تم إبلاغ البائع بالثغرة: 26.01.2024 تم إصدار الإصدار 5.0 الثابت الجديد: 06.06.2024 الإفصاح العام: 28.06.2024 الوصف ثغرة تزوير الطلبات من جانب الخادم SSRF في إضافة AdmirorFrames لـ Joomla! في ملف...

CVE-2024-5735

CVE-2024-5735 Extensão AdmirorFrames para Joomla! params'templatesBASE' = JPATHBASE . DIRECTORYSEPARATOR . 'plugins' . DIRECTORYSEPARATOR . 'content' . $path . 'templates' . DIRECTORYSEPARATOR;...

CVE-2026-76565

Reflected XSS via pricefrom / priceto Filter Parameters in PhocaCart PhocaCart ≤ 6.1.7 — مهاجم غير مصادق يحقن JavaScript عشوائيًا عبر عنوان URL مخصص لفلتر السعر الملخص إصدار PhocaCart 6.1.7 لنظام Joomla عرضة لثغرة XSS المنعكسة Reflected Cross-Site Scripting عبر معاملي GET pricefrom و priceto عند...

CVE-2026-77995

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client 3.2.0 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins...

EUVD-2026-64844

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client 3.2.0 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins...

CVE-2026-77995 Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client 3.2.0 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins...

CVE-2026-77995 Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client 3.2.0 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins...