CVE-2024-5735

CVE-2024-5735 AdmirorFrames Joomla! Extension params'templatesBASE' = JPATHBASE . DIRECTORYSEPARATOR . 'plugins' . DIRECTORYSEPARATOR . 'content' . $path . 'templates' . DIRECTORYSEPARATOR; This issue was caused by direct usage of JPATHBASE variable when constructing image path. This problem has...

Config-Exploiter

Config-Exploiter Config-Exploiter : dump config.php File From Joomla And Wordpress Websites Programmed By Belahsan Ouerghi . Installation sudo apt-get install git git clone https://github.com/TunisianEagles/Config-Exploiter.git cd Config-Exploiter chmod +x install.sh sudo ./install.sh chmod +x...

CVE-2023-27842

CVE-2023-27842 eXtplorer 2.1.15 – Insecure Permissions following Remote Code Execution Authenticated Vendor Homepage: http://extplorer.net/ Software Link: http://extplorer.net/attachments/download/99/eXtplorer2.1.15.zip Version: 2.1.15 Installation git clone https://github.com/0xFTW/CVE-2023-2784...

cve-2026-67363-67364

Balbooa Forms pre-auth RCE + Payment Tampering CVE-2026-67364 / CVE-2026-67363 PoC and detection templates for two pre-auth vulnerabilities in Balbooa Forms combaforms for Joomla, fixed in 2.4.3.2. CVE-2026-67364 — Pre-auth PHP Code Injection - RCE CVSS 9.8 CVE-2026-67363 — Pre-auth Payment Amoun...

CVE-2019-10945----Python3

CVE-2019-10945----Python3 Joomla! Core 1.5.0 - 3.9.4 - Directory Traversal / Authenticated Arbitrary File Deletion...

joomla_CVE-2023-23752

joomlaCVE-2023-23752 Joomla - a request parameter breaks through the Rest API Affected version ​ Joomla roughly has three routing entries, which are index.php in the root directory users access articles administrator/index.php in the root directory administrator management api/index.php in the ro...

CVE-2017-9934

CVE-2017-9934 I am the reporter of this exploit, under name: Envo Joomla 1.7.3 - 3.7.2 CSRF exploit PoC This vulnerability works due to Joomla versions 1.7.3 to 3.7.2 not sanitizing base64 input. Headers: POST...

joomla-cve-2015-8562-exploit-and-linux-forensic-analysis

joomla-cve-2015-8562-exploit-and-linux-forensic-analysis...

CVE-2024-5737

CVE-2024-5737 AdmirorFrames Joomla! Extension HTML tag: $height=0x3c; $im = imagecreate$width, $height; $hex=unpack'H',$payload; $chunks=strsplit$hex1, 6; for$i=0; $i count$chunks; $i++ $colorchunks=strsplit$chunks$i, 2;...

CVE-2026-61424

CVE-2026-61424 — DJ-Classifieds = 3.11.1 imageupload Task → No Auth → 3-String Filter Bypass Overview Unauthenticated arbitrary file upload in DJ-Classifieds for Joomla. The imageupload task endpoint processes file uploads without authentication and relies on a 3-string blocklist ?php, eval, base...

CVE-2023-23752

CVE-2023-23752 Joomla! Unauthorized Access Vulnerability POC: /api/index.php/v1/config/application?public=true Vulnerability Analysis https://xz.aliyun.com/t/12175...

Joomla-CVE-2023-23752-Exploit-Script

Usage python exploit.py http://example.com...

NekoBotV1

NekoBotV1Rev | Auto Exploiter With 500+ Exploit 2000+ Shell For Old version NekobotV1 NekoBotV1Rev is an auto exploit tool to facilitate the penetration of one or many websites Wordpress, Joomla, Drupal, Magento, Opencart,and Etc. Features : + Wordpress : 1- Cherry-Plugin 2- download-manager Plug...

CVE-2026-88854

CVE-2026-88854 — OrdaSoft Joomla Gallery SQL Injection Python 3 PoC scanner/exploit for CVE-2026-88854 in OrdaSoft OS Responsive Image Gallery for Joomla. | ---|--- Component| comosgallery, comosgallerylight Affected| 1.0.0 – 6.2.6 Fixed in| 6.2.7+ CVSS 4.0| 9.3 Critical Auth| None public...

CVE-2026-65761

CVE-2026-65761 - EasyStore Pro SQL Injection via filtersortby proof-of-concept This repository provides an educational proof of concept for CVE-2026-65761, an unauthenticated SQL injection vulnerability affecting versions 1.0.0 through 2.0.2 inclusive of the EasyStore Joomla extension. Only the P...

CVE-2023-23752

CVE-2023-23752 — Joomla! ⚠️ Disclaimer: This tool is intended for educational purposes and authorized penetration testing only. Use it only against systems you own or have explicit written permission to test. Unauthorized use is illegal. Table of Contents Overview Vulnerability Details How It Work...

CVE-2026-102427

CVE-2026-102427 — OrdaSoft OS CCK comoscck unauthenticated upload RCE Python 3 PoC for CVE-2026-102427 — OrdaSoft Joomla CCK — unauthenticated RCE via task=getContent → site/uploader.php GIF/PHP polyglot, .php filename. | ---|--- CVE.org| https://vulners.com/cve/CVE-2026-102427 PUBLISHED 2026-09-...

CVE-2026-49049

CVE-2026-49049 — Helix3 JoomShaper Joomla Unauthenticated AJAX RCE Scanner Mass scanner / verifier for CVE-2026-49049 : unauthenticated AJAX handler in the Helix3 Framework plugin for Joomla v1.0 – 3.1.0 , patched in 3.1.1+. Authorized testing only. Use only on systems you own or have written...

CVE-2020-15399

Exploit Title: Joomla! J2 JOBS 1.3.0 - 'sortby' Authenticated SQL Injection Date: 2020-06-17 Exploit Author: Mehmet Kelepçe / Gais Cyber Security Vendor Homepage: https://joomsky.com/ Software Link: https://joomsky.com/products/js-jobs-pro.html Change Log Update :...

Joomblah

Joomblah Exploit for Joomla 3.7.0 CVE-2017-8917 Explanation about the vulnerability: https://blog.sucuri.net/2017/05/sql-injection-vulnerability-joomla-3-7.html Code modification Modification in line 46 ... result += value.decode'utf-8' ... Usage Point the joomblah.py script at the vulnerable...