CVE-2026-21627---Tassos-Novarain-Framework-plg_system_nrframework-Exploit---Joomla

CVE-2026-21627 Nicht authentifizierte beliebige Dateieinbindung im Novarain Framework von Joomla nrframework Überblick Eine kritische Schwachstelle im Tassos/Novarain Framework plgsystemnrframework Joomla-Plugin ermöglicht es nicht authentifizierten Angreifern, beliebige PHP-Dateien auf dem Serve...

CVE-2026-49049

CVE-2026-49049 — Helix3 JoomShaper Joomla Unauthenticated AJAX RCE Scanner Massenscanner/Verifizierer für CVE-2026-49049 : nicht authentifizierter AJAX-Handler im Helix3 Framework -Plugin für Joomla v1.0 – 3.1.0 , gepatcht in 3.1.1+. Nur autorisierte Tests. Verwenden Sie dies nur auf Systemen, di...

CVE-2020-15399

Exploit Titel: Joomla! J2 JOBS 1.3.0 - 'sortby' Authentifizierte SQL-Injection Datum: 2020-06-17 Exploit-Autor: Mehmet Kelepçe / Gais Cyber Security Anbieter-Homepage: https://joomsky.com/ Software-Link: https://joomsky.com/products/js-jobs-pro.html Änderungsprotokoll Update:...

CVE-2020-13424

Titolo exploit: Joomla! Plugin XCloner Backup 3.5.3 - Local File Inclusion Autenticato Data: 2020-05-10 Autore exploit: Mehmet Kelepçe / Gais Cyber Security ID autore Exploit-DB: 8763 Riferimento: https://www.xcloner.com/xcloner-news/security-release-available-for-archived-joomla-version/ Homepag...

CVE-2026-57829

Helix Ultimate Framework — XSS Memorizzato Non Autenticato comajax → Session Riding Admin → Compromissione Completa Account Questo è il ritrovamento più significativo in questa cartella di ricerca — CRITICO, completamente confermato end-to-end. A differenza del bug solo di eliminazione in...

CVE-2026-66915 Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Remote code execution in Fabrik 4.7.2 - An unauthenticated attacker could execute arbitrary code by using the ajaxcalc feature of the calc plugin...

EUVD-2026-40122

The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters...

EUVD-2026-15653

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RSJoomla! RSFirewall! rsfirewall allows Stored XSS.This issue affects RSFirewall!: from n/a through = 1.1.45...

CVE-2026-21627 Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomla

The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s comajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction...

CVE-2026-21627

The CVE concerns the Tassos Framework plugin (Joomla) versions 4.10.14 through 6.0.37, where specific AJAX handling via Joomla com_ajax can invoke internal framework functionality without proper restrictions. This leads to a SQL injection and an unauthenticated file read, driven by how the plugin...

CVE-2010-0635

SQL injection vulnerability in the plgSearchEventsearch::onSearch method in eventsearch.php in the JEvents Search plugin 1.5 through 1.5.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: some of these details are obtained from third party...

EUVD-2010-0785

Malware in sbrugna...

EUVD-2023-32369

Malicious code in bioql PyPI...

EUVD-2023-32370

Malicious code in bioql PyPI...

EUVD-2025-21872

Malicious code in bioql PyPI...

EUVD-2023-32371

Malicious code in bioql PyPI...

CVE-2025-54475

A SQL injection vulnerability in the JS Jobs plugin versions 1.3.2-1.4.4 for Joomla allows low-privilege users to execute arbitrary SQL commands...

CVE-2025-49485

A SQL injection vulnerability in the Balbooa Forms plugin 1.0.0-2.3.1.1 for Joomla allows privileged users to execute arbitrary SQL commands via the 'id' parameter...

CVE-2025-49486

A stored XSS vulnerability in the Balbooa Gallery plugin 1.0.0-2.4.0 for Joomla allows privileged users to store malicious scripts in gallery items...

CVE-2025-49484 Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.1 for Joomla

A SQL injection vulnerability in the JS Jobs plugin versions 1.0.0-1.4.1 for Joomla allows low-privilege users to execute arbitrary SQL commands via the 'cvid' parameter in the employee application feature...