CVE-2023-27842

CVE-2023-27842 eXtplorer 2.1.15 – Insecure Permissions following Remote Code Execution Authenticated Vendor Homepage: http://extplorer.net/ Software Link: http://extplorer.net/attachments/download/99/eXtplorer2.1.15.zip Version: 2.1.15 Installation git clone https://github.com/0xFTW/CVE-2023-2784...

CVE-2019-15120

CVE-2019-15120 Exploit for XSS via BBCode on Kunena extension before 5.1.14 for Joomla! Information Description: In Kunena extension before 5.1.14 for Joomla!, it’s possible for any user to execute a stored XSS attack by sending special message in any field with BBcode support. As a result, the...

CVE-2026-56291

CVE-2026-56291 — Balbooa Forms Joomla Mass RCE Exploit Pre-Auth form.uploadAttachmentFile → No CSRF → PHP Upload Overview CVE-2026-56291 is a critical CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Balbooa Forms combaforms Joomla extension CISA KEV: Added July 10, 2026 — acti...

CVE-2026-76565

XSS Reflejado a través de los parámetros de filtro pricefrom / priceto en PhocaCart PhocaCart ≤ 6.1.7 — Un atacante no autenticado inyecta JavaScript arbitrario a través de una URL de filtro de precio manipulada RESUMEN PhocaCart 6.1.7 para Joomla es vulnerable a Cross-Site Scripting Reflejado XS...

CVE-2024-5736

CVE-2024-5736 AdmirorFrames Extensión de Joomla! 5.0 - Falsificación de Solicitud del Lado del Servidor Server-Side Request Forgery Cronología Vulnerabilidad reportada al proveedor: 26.01.2024 Nueva versión corregida 5.0 lanzada: 06.06.2024 Divulgación pública: 28.06.2024 Descripción Falsificació...

CVE-2026-102777

The Joomla Extension - svenbluege.de Event Gallery extension (versions

CVE-2026-102777 Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0

Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension 6.6.0 - The Google Photos picker of the back-end upload page fetches the thumbnails of the picked images through the server, with the OAuth access token of the Google Photos...

CVE-2026-102777 Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0

Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension 6.6.0 - The Google Photos picker of the back-end upload page fetches the thumbnails of the picked images through the server, with the OAuth access token of the Google Photos...

CVE-2026-102778

The Joomla Extension - svenbluege.de (Event Gallery extension) is vulnerable to Cross-Site Scripting (XSS) and Open Redirect in versions prior to 6.6.0 . When the "Share article links" option is enabled, the share mini page takes the article address from a shared link and prints it into the page ...

CVE-2026-102778 Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0

Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension 6.6.0 - The page a shared image link opens the share mini page of the front end can link the article the image was shared from when the option "Share article links" is on. I...

EUVD-2026-92451

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...

CVE-2026-102776

The Joomla Extension - svenbluege.de 's Event Gallery extension (versions

CVE-2026-102776 Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...

CVE-2026-102776 Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...

CVE-2024-5735

CVE-2024-5735 AdmirorFrames Joomla! Extension params'templatesBASE' = JPATHBASE . DIRECTORYSEPARATOR . 'plugins' . DIRECTORYSEPARATOR . 'content' . $path . 'templates' . DIRECTORYSEPARATOR; Este problema fue causado por el uso directo de la variable JPATHBASE al construir la ruta de la imagen. Es...

CVE-2024-5737

CVE-2024-5737 AdmirorFrames Joomla! Extension HTML tag: $height=0x3c; $im = imagecreate$width, $height; $hex=unpack'H',$payload; $chunks=strsplit$hex1, 6; for$i=0; $i count$chunks; $i++ $colorchunks=strsplit$chunks$i, 2;...

CVE-2026-65761

CVE-2026-65761 - Inyección SQL en EasyStore Pro a través de filtersortby prueba de concepto Este repositorio proporciona una prueba de concepto educativa para CVE-2026-65761, una vulnerabilidad de inyección SQL sin autenticación que afecta a las versiones 1.0.0 a 2.0.2 inclusive de la extensión...

CVE-2026-48908-by-yora

🔐 Escáner CVE-2026-48908 y PoC Seguro Joomla SP Page Builder — Carga de Archivos No Autenticada / RCE Potencial Desarrollado poryora 📌 Acerca de Este proyecto es una herramienta de investigación de seguridad y detección de vulnerabilidades desarrollada por yora para ayudar a identificar...

CVE-2026-102424 Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4

Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during public form submission. For every object whose id merely looks numeric, the...

EUVD-2026-89101

Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during public form submission. For every object whose id merely looks numeric, the...