CVE-2026-75951

J-BusinessDirectory extension (versions before 6.2.3) contains an Insecure Direct Object Reference flaw across multiple frontend/API actions, allowing unauthenticated remote attackers to access or modify other users' data; CVSS 6.9 (Medium). Remediation is to upgrade to version 6.2.3 or later. No...

CVE-2026-75951 Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference (multiple frontend/API actions) in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference multiple frontend/API actions in J-BusinessDirectory 6.2.3...

EUVD-2026-62491

Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory 6.2.3 - Pagination values were not strictly typed. Array/non-numeric values for example limitstart could trigger PHP type errors in arithmetic, and limit was not validated before use in list...

EUVD-2026-62490

Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory 6.2.3 - Search keywords and ORDER BY were concatenated into SQL. 6.2.3 quotes keywords and allow-lists the sort clause...

CVE-2026-74803

Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group...

EUVD-2026-62434

Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group...

CVE-2026-74803 Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64

Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group...

CVE-2026-74803 Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64

Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group...

CVE-2026-75114

The Joomla Zoo extension (versions before 4.1.64) passes the unsanitized referer request parameter directly to setRedirect() in CommentController::twitterAuthenticate(), enabling phishing via crafted redirect URLs. CVSS 5.1 (MEDIUM) with network access and user interaction required. No in-the-wil...

CVE-2026-75114 Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64

Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate in Zoo 4.1.64 - The referer request parameter is passed straight to setRedirect with no validation...

EUVD-2026-62430

Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element in Zoo 4.1.64 - The filtertype request value is interpolated into the query as a.type = "..." and the typefilter array as a.type IN "...", with no quoting or escaping...

CVE-2026-74804 Joomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.64

Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element in Zoo 4.1.64 - The filtertype request value is interpolated into the query as a.type = "..." and the typefilter array as a.type IN "...", with no quoting or escaping...

CVE-2026-74804 Joomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.64

Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element in Zoo 4.1.64 - The filtertype request value is interpolated into the query as a.type = "..." and the typefilter array as a.type IN "...", with no quoting or escaping...

CVE-2026-67363

The stripeCharges and payAuthorize endpoints in Balbooa Forms (versions before 2.4.3.2) accept the charge total from a client-controlled parameter without recomputing it from configured prices and lack authentication or CSRF checks. An unauthenticated attacker can purchase priced items for arbitr...

PT-2026-78367

Name of the Vulnerable Software and Affected Versions Zoo versions prior to 4.1.64 Description An unauthenticated SQL injection exists in the element function of the ItemController. The issue occurs because the filter type request value and the type filter array are interpolated into the database...

PT-2026-78453

Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory 6.2.3 - Search keywords and ORDER BY were concatenated into SQL. 6.2.3 quotes keywords and allow-lists the sort clause...

CVE-2026-74254

Joomla Extension - joomlack.fr - SQL injection in Page Builder CK 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to the styles model. Version 3.6.4 fixed the vector in the frontend, 3.6.5 in the backend...

CVE-2026-74253 Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 16.0.0

Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer 16.0.0 - Regular Labs Sourcerer before 16.0.0 processes source blocks found in Joomla’s final rendered HTML without reliably determining where that code originated...

CVE-2026-74253

Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer 14.0.0 - Regular Labs Sourcerer before 14.0.0 processes source blocks found in Joomla’s final rendered HTML without reliably determining where that code originated...

CVE-2026-74253 Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 16.0.0

Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer 16.0.0 - Regular Labs Sourcerer before 16.0.0 processes source blocks found in Joomla’s final rendered HTML without reliably determining where that code originated...