893 matches found
EUVD-2026-75386
Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha when no captcha plugin is enabled and has no rate limitin...
CVE-2026-78374 Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0
Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha when no captcha plugin is enabled and has no rate limitin...
CVE-2026-78083 Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.4
Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property 4.1.4 - The visitor booking properties.booking and agent contact form submission agents.sendmail endpoints processed POST requests without verifying Joomla session...
CVE-2026-78083 Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.4
Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property 4.1.4 - The visitor booking properties.booking and agent contact form submission agents.sendmail endpoints processed POST requests without verifying Joomla session...
EUVD-2026-75391
Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property 4.1.4 - The visitor booking properties.booking and agent contact form submission agents.sendmail endpoints processed POST requests without verifying Joomla session...
CVE-2026-78083
The SP Property Joomla extension (by joomshaper.com) contains a missing CSRF token verification vulnerability affecting versions prior to 4.1.4 . Specifically, the visitor booking endpoint (properties.booking ) and the agent contact form submission endpoint (agents.sendmail ) processed POST reque...
CVE-2026-78084
SP Property (a Joomla extension by joomshaper.com) versions below 4.1.4 contain a Missing Access Control vulnerability in the gallery image management controller. The affected controller tasks lacked authorization checks and CSRF token validation , allowing users to invoke file removal actions wi...
CVE-2026-78084 Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4
Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with arbitrary path strings or upload unverified fi...
EUVD-2026-75392
Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with arbitrary path strings or upload unverified fi...
CVE-2026-78084 Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4
Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with arbitrary path strings or upload unverified fi...
CVE-2026-78082 Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4
Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property 4.1.4 - The property search and listing query builders assembled several WHERE and ORDER BY clauses zipcode, sorting, pricerangedropdown, and psizerangedropdown by directly...
CVE-2026-78082
SP Property is a Joomla extension by joomshaper.com vulnerable to unauthenticated SQL injection in versions prior to 4.1.4 . The root cause lies in the property search and listing query builders, which assembled WHERE and ORDER BY clauses (for zipcode, sorting, price_range_dropdown, and psize_ran...
CVE-2026-78082 Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4
Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property 4.1.4 - The property search and listing query builders assembled several WHERE and ORDER BY clauses zipcode, sorting, pricerangedropdown, and psizerangedropdown by directly...
CVE-2026-78303
SP Property Joomla Extension by joomshaper.com (versions below 4.1.4 ) contains an unvalidated email destination and form manipulation vulnerability in its booking request handling. The root cause is that booking inquiries previously relied on client-submitted hidden fields for recipient email ro...
CVE-2026-78303 Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4
Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property 4.1.4 - Booking inquiries previously relied on client-submitted hidden fields for recipient routing, allowing potential email manipulation...
CVE-2026-78303 Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4
Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property 4.1.4 - Booking inquiries previously relied on client-submitted hidden fields for recipient routing, allowing potential email manipulation...
EUVD-2026-75368
Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property 4.1.4 - Booking inquiries previously relied on client-submitted hidden fields for recipient routing, allowing potential email manipulation...
CVE-2026-78069
Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - J2StoreControllerApps's appTask delegation path instantiates app-plugin controllers with no ACL check anywhere in the code. It currently returns 403...
CVE-2026-78064
Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF save task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - fof.xml grants the carts view's tasks a wildcard true ACL, and FOF only enforces CSRF tokens on back-end HTML requests, not on front-end format=raw...