CVE-2026-90902

The Joomla Extension - joomshaper.com - Easy Store (versions 1.0.0-3.0.0 ) is vulnerable to an Authenticated, Privileged SQL Injection within the coupon bulk update task. The flaw exists because input IDs in ProductCoupon.php and CouponsModel.php are directly concatenated into raw SQL IN (...) cl...

EUVD-2026-85552

Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update task administrator/index.php?option=comeasystore&task=coupon.couponBulkUpdate took input IDs and directly concatenated them into raw SQL I...