21777 matches found
Joomla! ChronoForums 2.0.11 - Local File Inclusion
Joomla! ChronoForums 2.0.11 avatar function is vulnerable to local file inclusion through unauthenticated path traversal attacks. This enables an attacker to read arbitrary files, for example the Joomla! configuration file which contains credentials. id: CVE-2021-28377 info: name: Joomla!...
Joomla Easy Store - SQL Injection
Joomla Easy Store extension 1.0.0-2.0.1 contains an unauthenticated SQL injection caused by improper validation of order parameters, letting unauthenticated attackers read the full database including credentials and sessions. id: CVE-2026-65761 info: name: Joomla Easy Store - SQL Injection author...
Joomla! JCE extension < 2.9.99.5 unauthenticated RCE
Joomla JCE editor extension contains an unrestricted file upload vulnerability caused by allowing unauthenticated users to create new editor profiles, letting attackers upload and execute PHP code remotely, exploit requires no authentication. id: CVE-2026-48907 info: name: Joomla! JCE extension...
Balbooa Forms < 2.4.1 - Unauthenticated Arbitrary File Upload
Joomla Balbooa Forms contains an unrestricted file upload vulnerability caused by lack of authentication checks, letting unauthenticated attackers upload executable files and achieve remote code execution. id: CVE-2026-56291 info: name: Balbooa Forms 2.4.1 - Unauthenticated Arbitrary File Upload...
Page Builder CK <= 3.5.10 - Unauthenticated Arbitrary File Upload
Joomla Page Builder CK contains an unrestricted file upload vulnerability caused by lack of proper validation, letting unauthenticated attackers upload executable files and achieve remote code execution. id: CVE-2026-56290 info: name: Page Builder CK = 3.5.10 - Unauthenticated Arbitrary File Uplo...
Joomla! Component News Portal 1.5.x - Local File Inclusion
A directory traversal vulnerability in the iJoomla News Portal comnewsportal component 1.5.x for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1312 info: name: Joomla! Component News Portal 1.5.x - Local File...
CVE-2026-48907
CVE-2026-48907 β Joomla JCE Unauthenticated RCE Lab PSsec Educational security research lab for CVE-2026-48907. Overview CVE-2026-48907 is a critical CVSS 10.0 unauthenticated remote code execution vulnerability in JCE Joomla Content Editor , the most widely installed editor extension for Joomla,...
CVE-2026-57830
Helix Ultimate Framework β Unauthenticated Path-Traversal Arbitrary File/Folder Read+Delete This is a confirmed DoS + cross-tenant filesystem access vulnerability, NOT RCE. An RCE-escalation theory delete configuration.php to re-expose the Joomla installer was tested live and disproved β see "RCE...
setup-cve-2015-8562
Joomla! RCE CVE 2015-8562 Docker compose file to setup environment for CVE 2015-8562 testing Table of Contents 1. About The Project 2. Getting Started Prerequisites Installation 3. Usage 4. Contributing 5. License About The Project This project includes a Docker compose file to setup environment...
CVE-2023-23752
CVE-2023-23752 A bash script that exploits the vulnerable endpoints for the Joomla! API 4.0 - 4.2.7 through the use of curl and automation. Testing Environment Tryhackme: https://tryhackme.com/r/room/joomify...
CVE-2026-49049
CVE-2026-49049 Vulnerability Analysis: Unauthenticated Arbitrary File Write in JoomShaper Helix3 Joomla This repository contains materials, technical analysis, and a Proof of Concept PoC for the critical vulnerability CVE-2026-49049 found in the outdated template framework Helix3 by JoomShaper fo...
CVE-2026-48909-Joomla-SP-Exploit
CVE-2026-48909 Joomla SP LMS β Unauthenticated PHP Object Injection β RCE Proof-of-concept assessment tool for CVE-2026-48909 Author: Sudeepa Wanigarathna !IMPORTANT Authorized use only. This tool is for security research, education, and testing systems you own or have explicit written permission...
CVE-2026-48907
π¨ CVE-2026-48907 - JCE Joomla Content Editor Unauthenticated Remote Code Execution β οΈ Critical Unauthenticated RCE in JCE Joomla Content Editor A critical access control vulnerability allowing unauthenticated attackers to compromise vulnerable Joomla installations running JCE. π Overview...
CVE-2023-23752
Joomla! options Arguments url: Root URL base path of the target Joomla! site, including the HTTP scheme, port, and root folder if necessary. --debug: Optional. If set, the script will print debug information, including the fetched data. --no-color: Optional. If set, disables colored output for...
CVE-2023-23752
CVE-2023-23752 CVE-2023-23752 Joomla Unauthenticated Information Disclosure Description Supports high-concurrency detection Write url into urls.txt, only supports http://ip:port & https://ip:port format Use the -p parameter to add a proxy Just run Usage Help .\CVE-2023-23752.exe -h ββββββββββ...
Joomla-3.4.4-3.6.4_CVE-2016-8869_and_CVE-2016-8870
This repository does not have a README...
HTB-Devvortex-CVE-2023-2375-PoC
Joomla! CVE-2023-23752 - Unauthenticated Information Disclosure PoC Description This repository contains a Proof of Concept PoC exploit for CVE-2023-23752, a vulnerability in Joomla! that allows unauthenticated information disclosure. This vulnerability can expose sensitive information, including...
CVE-2023-23752
CVE-2023-23752 This is a proof-of-concept code for the CVE-2023-23752 vulnerability. It allows an attacker to extract sensitive information such as usernames, passwords, and database names from a target application. Bulk scanner + get config + ip target from CVE-2023-23752 Screenshot Installation...
CVE-2026-48907
CVE-2026-48907 Educational PoC β οΈ This repository is for educational and defensive security purposes only. Test only on systems you own or are explicitly authorized to assess. Do not use this project against third-party systems. This PoC demonstrates CVE-2026-48907, an unauthenticated RCE...
CVE-2026-48908-Joomla-SP-Page-Builder-RCE
π‘οΈ CVE-2026-48908 Analysis Unauthenticated Arbitrary File Upload to RCE in JoomShaper SP Page Builder -critical?style=for-the-badge&logo=alert -black?style=for-the-badge&logo=github A comprehensive technical breakdown of an unauthenticated remote code execution vulnerability. π Executive Summary...