CVE-2025-54300 Extension - norrnext.com - Stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla

A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. The SVG upload feature does not sanitize uploads...

CVE-2025-54301 Extension - norrnext.com - Stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla

A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. File names are not properly escaped...

Norrnext Quantum Manager component for Joomla 跨站脚本漏洞

Norrnext Quantum Manager component for Joomla is a file and media management extension from Norrnext, Inc. A cross-site scripting vulnerability exists in the Norrnext Quantum Manager component for Joomla versions 1.0.0-3.2.0, which stems from the SVG upload function not cleaning up the uploaded...

CVE-2025-54473

An authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla was discovered. The issue allows code execution via the unzip feature...

CVE-2025-54475 Extension - joomsky.com - SQL injection in JS jobs component version 1.3.2 - 1.4.4 for Joomla

A SQL injection vulnerability in the JS Jobs plugin versions 1.3.2-1.4.4 for Joomla allows low-privilege users to execute arbitrary SQL commands...

CVE-2025-54475

This CVE (CVE-2025-54475) affects the JS Jobs plugin for Joomla, versions 1.3.2–1.4.4. The issue is a SQL injection that can be triggered by low-privilege users and may allow execution of arbitrary SQL commands. The vulnerability is classified with CVSS v4.0: AV:N/AC:L/PR:L/UI:N/VC:H/VI:H/SI:N/VA...

CVE-2025-54474 Extension - dj-extensions.com - SQLi vulnerability in DJ-Classifieds component 3.9.2-3.10.1 for Joomla

A SQLi vulnerability in DJ-Classifieds component 3.9.2-3.10.1 for Joomla was discovered. The issue allows privileged users to execute arbitrary SQL commands...

CVE-2025-54474

CVE-2025-54474 describes a SQL injection vulnerability in the DJ-Classifieds Joomla extension, affecting versions 3.9.2–3.10.1. The issue allows privileged users to execute arbitrary SQL commands. The connected documents consistently reference a DJ-Classifieds SQLi impacting Joomla; no exploitati...

CVE-2025-54473

CVE-2025-54473 is an authenticated remote code execution flaw in Phoca Commander for Joomla, affecting versions 1.0.0–4.0.0 and 5.0.0–5.0.1. The issue arises from the unzip feature, enabling code execution after authentication. The CVSSv4 base score is 9.2 (CRITICAL) with high impact to confident...

CVE-2025-54473 Extension - phoca.cz - Authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla

An authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla was discovered. The issue allows code execution via the unzip feature...

CVE-2025-54473 Extension - phoca.cz - Authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla

An authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla was discovered. The issue allows code execution via the unzip feature...

📄 Joomla JS Jobs 1.4.2 SQL Injection

Joomla JS Jobs plugin version 1.4.2 suffers from a remote SQL injection vulnerability. Exploit Title: Joomla JS Jobs plugin 1.4.2 - SQL injection Google Dork: n/a Date: 07/07/2025 Exploit Author: Adam Wallwork Vendor Homepage: https://joomsky.com/ Demo: https://demo.joomsky.com/js-jobs/jm/free/...

CVE-2025-26855

A SQL injection in Articles Calendar extension 1.0.0 - 1.0.1.0007 for Joomla allows attackers to execute arbitrary SQL commands...

CVE-2025-26855 Extension - joomcar.net - SQL injection in Articles Calendar 1.0.0 - 1.0.1.0007 for Joomla

A SQL injection in Articles Calendar extension 1.0.0 - 1.0.1.0007 for Joomla allows attackers to execute arbitrary SQL commands...

CVE-2025-26855

The CVE-2025-26855 entry pertains to a SQL injection in the Joomla plugin/extension “Articles Calendar” (versions 1.0.0 through 1.0.1.0007) by Joomcar Extensions. The vulnerability arises in this extension and allows an attacker to execute arbitrary SQL commands. Affected component: Articles Cale...

CVE-2025-26855 Extension - joomcar.net - SQL injection in Articles Calendar 1.0.0 - 1.0.1.0007 for Joomla

A SQL injection in Articles Calendar extension 1.0.0 - 1.0.1.0007 for Joomla allows attackers to execute arbitrary SQL commands...

CVE-2025-26854 Extension - joomcar.net - SQL injection in Articles Good Search 1.0.0 - 1.2.4.0011 for Joomla

A SQL injection in Articles Good Search extension 1.0.0 - 1.2.4.0011 for Joomla allows attackers to execute arbitrary SQL commands...

CVE-2025-26854 Extension - joomcar.net - SQL injection in Articles Good Search 1.0.0 - 1.2.4.0011 for Joomla

A SQL injection in Articles Good Search extension 1.0.0 - 1.2.4.0011 for Joomla allows attackers to execute arbitrary SQL commands...

CVE-2025-26854

The CVE-2025-26854 entry describes a SQL injection in the Joomla extension Articles Good Search (versions 1.0.0–1.2.4.0011). In affected releases, attackers can execute arbitrary SQL commands. Mitigation: upgrade to a version later than 1.2.4.0011 (per PT-2025-30010) or apply vendor-provided fixe...

PT-2025-30011 · Joomla · Articles Calendar

Name of the Vulnerable Software and Affected Versions: Articles Calendar versions 1.0.0 through 1.0.1.0007 Description: A SQL injection issue exists in the Articles Calendar extension for Joomla. This allows attackers to execute arbitrary SQL commands. Recommendations: Update Articles Calendar to...