joomla-bruteforce

joomla-bruteforce Joomla login bruteforce Tested on Joomla! 3.8.8 Usage: python3 joomla-brute.py -u http://10.10.10.150 -w /usr/share/wordlist/rockyou.txt -usr admin chmod +x joomla-brute.py ./joomla-brute.py -u http://10.10.10.150 -w /usr/share/wordlist/rockyou.txt -usr admin Optional parameters...

cve-2026-67363-67364

Balbooa Forms pre-auth RCE + Payment Tampering CVE-2026-67364 / CVE-2026-67363 PoC and detection templates for two pre-auth vulnerabilities in Balbooa Forms combaforms for Joomla, fixed in 2.4.3.2. CVE-2026-67364 — Pre-auth PHP Code Injection - RCE CVSS 9.8 CVE-2026-67363 — Pre-auth Payment Amoun...

Joomla! Component iF surfALERT 1.2 - Local File Inclusion

A directory traversal vulnerability in the iF surfALERT comifsurfalert component 1.2 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1717 info: name: Joomla! Component i...

Joomla! Component CCNewsLetter - Local File Inclusion

A directory traversal vulnerability in the ccNewsletter comccnewsletter component 1.0.5 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter in a ccnewsletter action to index.php. id: CVE-2010-0467 info: name: Joomla! Component CCNewsLetter -...

Joomla! Component Zh BaiduMap 3.0.0.1 - SQL Injection

SQL Injection exists in the Zh BaiduMap 3.0.0.1 component for Joomla! via the id parameter in a getPlacemarkDetails, getPlacemarkHoverText, getPathHoverText, or getPathDetails request. id: CVE-2018-6605 info: name: Joomla! Component Zh BaiduMap 3.0.0.1 - SQL Injection author: DhiyaneshDk severity...

Joomla! Helpdesk Pro plugin <1.4.0 - Local File Inclusion

Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter in a ticket.downloadattachment task. id: CVE-2015-4074 info: name: Joomla! Helpdesk Pro plugin 1.4.0 - Local File...

CVE-2019-10945----Python3

CVE-2019-10945----Python3 Joomla! Core 1.5.0 - 3.9.4 - Directory Traversal / Authenticated Arbitrary File Deletion...

joomla-cve-2015-8562-exploit-and-linux-forensic-analysis

joomla-cve-2015-8562-exploit-and-linux-forensic-analysis...

CVE-2026-65761

CVE-2026-65761 - EasyStore Pro SQL Injection via filtersortby proof-of-concept This repository provides an educational proof of concept for CVE-2026-65761, an unauthenticated SQL injection vulnerability affecting versions 1.0.0 through 2.0.2 inclusive of the EasyStore Joomla extension. Only the P...

CVE-2023-23752

CVE-2023-23752 — Joomla! ⚠️ Disclaimer: This tool is intended for educational purposes and authorized penetration testing only. Use it only against systems you own or have explicit written permission to test. Unauthorized use is illegal. Table of Contents Overview Vulnerability Details How It Work...

CVE-2026-49049

CVE-2026-49049 — Helix3 JoomShaper Joomla Unauthenticated AJAX RCE Scanner Mass scanner / verifier for CVE-2026-49049 : unauthenticated AJAX handler in the Helix3 Framework plugin for Joomla v1.0 – 3.1.0 , patched in 3.1.1+. Authorized testing only. Use only on systems you own or have written...

CVE-2026-48908

CVE-2026-48908 — SP Page Builder Unauthenticated RCE SP Page Builder comsppagebuilder for Joomla ≤ 6.6.1 allows unauthenticated attackers to upload arbitrary files and achieve Remote Code Execution. Field| Value ---|--- CVE| CVE-2026-48908 CWE| CWE-284 Improper Access Control Component| SP Page...

Joomla-CVE-Detector-CVE-2022-27913-

Joomla-CVE-Detector-CVE-2022-27913- Identify instances of Joomla that are affected by CVE-2022-27913...

CVE-2026-65883

CVE-2026-65883 — Aimy Captcha-Less Form Guard = 20.0 clfgd Field → XOR Recovery → unserialize → FormattedtextLogger → RCE Overview Unauthenticated PHP Object Injection in Aimy Captcha-Less Form Guard for Joomla. The onCheckAnswer method base64-decodes the attacker-controlled clfgd POST field, run...

CVE-2026-48908

CVE-2026-48908 — SP Page Builder Joomla Unauthenticated RCE Proof-of-concept exploit for CVE-2026-48908 , a critical CVSS 4.0 = 10.0 unauthenticated remote-code-execution vulnerability in the SP Page Builder component comsppagebuilder for Joomla, by JoomShaper. | ---|--- CVE| CVE-2026-48908...

CVE-2026-48907

CVE-2026-48907 — Unauthenticated RCE in Joomla Content Editor JCE ≤ 2.9.99.4 Proof-of-concept exploit for CVE-2026-48907 — a CVSS 10.0 pre-authentication remote code execution vulnerability in the Joomla Content Editor JCE extension. Research by Grayxploit Security Team Table of Contents Overview...

base-joomla

BASE-JOOMLA This is part of Cved: a tool to manage vulnerable docker containers. Cved: https://github.com/git-rep-src/cved Image source: https://github.com/cved-sources/base-joomla Image based on: https://github.com/Medicean/VulApps/tree/master/base/joomla/3.7...

CVE-2026-21627---Tassos-Novarain-Framework-plg_system_nrframework-Exploit---Joomla

CVE-2026-21627 Unauthenticated Arbitrary File Inclusion in Joomla's Novarain Framework nrframework Overview A critical vulnerability in the Tassos/Novarain Framework plgsystemnrframework Joomla plugin allows unauthenticated attackers to include arbitrary PHP files on the server, instantiate...

scanner-exploit-joomla-CVE-2015-8562

scanner-exploit-joomla-CVE-2015-8562...

CVE-2023-23752-poc

Affected versions: 4.0.0 = 4.2.8 Joomla 3 and below are not affected by this vulnerability. http://127.0.0.1/Joomla/api/index.php/v1/config/application?public=true This API is used to obtain the most important configuration information of the website, including the database username and password...