CVE-2026-64873

Custom query URLs could access internal or reserved network services...

CVE-2026-64871

Administrator URL purges did not consistently require a valid token and cache-management permission...

CVE-2026-65430

MaxMind credentials where leaked in request URLs, causing a credential leakage vulnerability...

CVE-2026-64797

CVE-2026-64797 affects the Joomla extension from regularlabs.com (IP Login). The vulnerability arises because the extension trusts forwarded client-IP headers without requiring a configured trusted proxy, allowing an attacker to spoof the IP used for automatic login and potentially impersonate ma...

CVE-2026-63265

CVE-2026-63265 affects the Joomla Regular Labs extension (Regular Labs AJAX endpoints). The issue arises from inconsistent CSRF token validation and privilege checks that don’t consistently align with component/item permissions and trusted server-generated form configuration. As a result, authent...

CVE-2026-63280

The CVE-2026-63280 entry concerns the Joomla extension Regular Labs Conditions Manager. Affected component/function: conditions administration within the extension. Root cause: inconsistent enforcement of tokens (CSRF protection) and of component/mapped-item permissions. This could enable imprope...

CVE-2026-63683

The CVE-2026-63683 entry concerns the Joomla extension from Regular Labs (the Regular Labs conditions manager). The description in the connected CVE records states that IP and GeoIP conditions trust spoofable forwarded headers, enabling remote clients to bypass location-based rules. The root caus...

CVE-2026-64798

CVE-2026-64798 affects a Joomla extension by Regular Labs (IP login extension). The issue is that persistent URL login keys are generated using a non-cryptographic random generator with insufficient entropy, which could undermine the security of persistent login tokens. The connected documents co...

CVE-2026-64795

CVE-2026-64795 affects Regular Labs Joomla extensions. The issue arises from tag-provided custom HTML, module content/title overrides, and decoded modal/tooltip values that can render unsafe markup, enabling a content author to inject JavaScript that executes in visitors’ browsers. The sources co...

CVE-2026-63281

CVE-2026-63281 affects the Regular Labs Conditions Manager Joomla extension. The issue is a stored cross-site scripting (XSS) vulnerability where stored condition values can execute HTML/JavaScript in administrator summaries. This is documented in CVE records from NVD and CVE List, describing the...

CVE-2026-64791

CVE-2026-64791 relates to the Regular Labs Extension Manager for Joomla. The issue is described as inconsistent enforcement of component-management and installation permissions on administrator routes and during install/update/uninstall processing. The underlying risk is that an unauthorized back...

CVE-2026-63684

CVE-2026-63684 affects Regular Labs Joomla extensions (Regular Labs) where administrator actions, editor popups, and import/export requests lacked consistent token, item-permission, and input-validation checks. The root cause is insufficient CSRF/token and permission validation in admin/import/ex...

CVE-2026-63684 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension

Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks. Unauthorized backend users or CSRF attacks could expose, create or modify extension configuration and items...

All Regular Labs extensions with editor buttons

All Regular Labs extensions with editor buttons, versions before 7 September 2018, cross site scripting XSS:- - Articles Anywhere - Conditional Content - Dummy Content - Modals - Modules Anywhere - Sliders - Snippets - Tabs - Tooltips The editor button popup urls could potentially be used...

AddToMenu Joomla Extensions Free: source code security analysis report

Several vulnerabilities were discovered in Regular Labs 'AddToMenu Joomla Extensions Free' software: Incorrect Permissions for External Entities During XML Document Processing Incorrect User Input Filtration when Generating Code on the Fly...