1187 matches found
CVE-2026-115451
Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15, 3.1.4-3.1.8 and Smile Pack 1.2.7-1.2.9, 2.1.2-2.1.6 - Anyone could delete images in the Gallery folders, including images on published articles and modules, without...
CVE-2026-115452
Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6 - A user who could edit a Map marker label, like an article author, could add a script that ran for anyone who opened the marker...
CVE-2026-107903
Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox 2.20.5.0...
EUVD-2026-117631
Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15, 3.1.4-3.1.8 and Smile Pack 1.2.7-1.2.9, 2.1.2-2.1.6 - Anyone could delete images in the Gallery folders, including images on published articles and modules, without...
CVE-2026-118494 Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9
Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9 - JReviews caches its full settings table, including the Joomla global configuration secret copied into cmssecret and third-party API keys and secrets, to a serialized file under...
CVE-2026-107130
The Joomla Extension - balbooa.com , specifically the Gridbox component, is vulnerable to an unauthenticated deletion of submission and field files in versions prior to 2.20.5.0 . The root cause involves Missing Authorization (CWE-862) and an Authorization Bypass Through User-Controlled Key (CWE-...
CVE-2026-107130 Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.0
Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox 2.20.5.0...
CVE-2026-107130 Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.0
Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox 2.20.5.0...
CVE-2026-107903
The Joomla Extension by balbooa.com contains a Stored XSS vulnerability in the reviews section. The root cause is inconsistent sanitization within the Gridbox component. This affects versions of Gridbox prior to 2.20.5.0 . The vulnerability allows an attacker to execute malicious scripts in the c...
CVE-2026-107903 Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox < 2.20.5.0
Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox 2.20.5.0...
CVE-2026-107903 Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox < 2.20.5.0
Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox 2.20.5.0...
EUVD-2026-117627
Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox 2.20.5.0...
EUVD-2026-117625
Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6 - A user who could edit a Map marker label, like an article author, could add a script that ran for anyone who opened the marker...
CVE-2026-115452
The Joomla Extension - tassos.gr is vulnerable to a privileged stored XSS flaw in Advanced Custom Fields (versions 2.8.2-2.8.15, 3.0.0-3.1.8) and Smile Pack (versions 1.1.2-1.2.9, 2.0.0-2.1.6). The root cause allows a privileged user, such as an article author with permissions to edit a Map marke...
CVE-2026-115452 Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6
Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6 - A user who could edit a Map marker label, like an article author, could add a script that ran for anyone who opened the marker...
CVE-2026-105606 Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8
Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission for...
CVE-2026-105606 Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8
Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission for...
CVE-2026-105606
The Joomla Extension - joomlaboat.com (versions prior to 3.7.8 ) is vulnerable to an unauthenticated arbitrary file upload in the Custom Tables component. An attacker can upload a polyglot file with a controlled extension to a web-accessible tmp directory via a public submission form, as the stor...
EUVD-2026-115360
Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds 3.11.3 - A “duplicate my ad” convenience feature on the new-ad form site/models/additem.php loaded an existing advert by its raw numeric ID with no check that the ad belonged to the...