65 matches found
CVE-2026-78070
Injection SQL via Shortcode ORDER BY dans plgcontentdpcalendar DPCalendar Free ≤ 10.11.2 — Un utilisateur de niveau Auteur extrait l'intégralité de la base de données via une injection aveugle basée sur le temps RÉSUMÉ Le plugin de contenu plgcontentdpcalendar analyse les shortcodes events...
CVE-2026-21627---Tassos-Novarain-Framework-plg_system_nrframework-Exploit---Joomla
CVE-2026-21627 تضمين ملفات تعسفي غير مصادق عليه في إطار Novarain الخاص بـ Joomla nrframework نظرة عامة ثغرة أمنية حرجة في إضافة Tassos/Novarain Framework plgsystemnrframework الخاصة بـ Joomla تسمح للمهاجمين غير المصادق عليهم بتضمين ملفات PHP تعسفية على الخادم، وإنشاء كائنات classes تعسفية، وسلسلة...
CVE-2020-13424
शोषण शीर्षक: Joomla! प्लगइन XCloner बैकअप 3.5.3 - स्थानीय फ़ाइल समावेशन प्रमाणित दिनांक: 2020-05-10 शोषण लेखक: मेहमत केलेप्से / गैस साइबर सुरक्षा एक्सप्लॉइट-डीबी लेखक आईडी: 8763 संदर्भ: https://www.xcloner.com/xcloner-news/security-release-available-for-archived-joomla-version/ विक्रेता होमपेज:...
CVE-2026-57829
إطار Helix Ultimate — ثغرة XSS مخزنة غير موثقة comajax → سرقة جلسة المدير → استيلاء كامل على الحساب هذا هو أقوى اكتشاف في مجلد البحث هذا — حرج، مؤكد بالكامل من النهاية إلى النهاية. على عكس الثغرة التي تسمح بالحذف فقط في helixultimatedeletepoc.md، فهذه الثغرة تمتلك مسارًا حقيقيًا وعمليًا للوصول إل...
CVE-2026-49049
CVE-2026-49049 — Helix3 JoomShaper Joomla अप्रमाणित AJAX RCE स्कैनर मास स्कैनर / सत्यापनकर्ता CVE-2026-49049 के लिए: Joomla के Helix3 Framework प्लगइन में अप्रमाणित AJAX हैंडलर v1.0 – 3.1.0 , 3.1.1+ में पैच किया गया। केवल अधिकृत परीक्षण। केवल उन प्रणालियों पर उपयोग करें जिनके आप मालिक हैं या जिनक...
CVE-2020-15399
शोषण शीर्षक: Joomla! J2 JOBS 1.3.0 - 'sortby' प्रमाणित SQL इंजेक्शन दिनांक: 2020-06-17 शोषण लेखक: Mehmet Kelepçe / Gais Cyber Security विक्रेता होमपेज: https://joomsky.com/ सॉफ्टवेयर लिंक: https://joomsky.com/products/js-jobs-pro.html परिवर्तन लॉग अपडेट: https://joomsky.com/products/js-jobs.html...
CVE-2026-78074 Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions
Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions - a missing authentication check allows unauthenticated actors to delete arbitrary installed extensions. Only the free versions of the miniOrange plugins are affected...
CVE-2026-66915 Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Remote code execution in Fabrik 4.7.2 - An unauthenticated attacker could execute arbitrary code by using the ajaxcalc feature of the calc plugin...
Exploit for Improper Access Control in Ollyo Helix3
CVE-2026-49049 — Helix3 JoomShaper Joomla Unauthenticated AJ...
Exploit for Improper Access Control in Ollyo Helix3
CVE-2026-49049 — Helix3 Joomla Plugin JoomShaper Unauthenticat...
EUVD-2026-40122
The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters...
EUVD-2026-15653
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RSJoomla! RSFirewall! rsfirewall allows Stored XSS.This issue affects RSFirewall!: from n/a through = 1.1.45...
CVE-2026-21627
The CVE concerns the Tassos Framework plugin (Joomla) versions 4.10.14 through 6.0.37, where specific AJAX handling via Joomla com_ajax can invoke internal framework functionality without proper restrictions. This leads to a SQL injection and an unauthenticated file read, driven by how the plugin...
CVE-2026-21627 Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomla
The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s comajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction...
CVE-2010-0635
SQL injection vulnerability in the plgSearchEventsearch::onSearch method in eventsearch.php in the JEvents Search plugin 1.5 through 1.5.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: some of these details are obtained from third party...
EUVD-2010-0785
Malware in sbrugna...
EUVD-2023-32370
Malicious code in bioql PyPI...
EUVD-2023-32371
Malicious code in bioql PyPI...