9 matches found
CVE-2026-102779
Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task records.customaction without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token enforcement. A Guest can supply...
CVE-2026-102780
Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public RecordController. Its shared frontend save controller accepts the raw jform array, assigns...
CVE-2026-102779 Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4
Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task records.customaction without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token enforcement. A Guest can supply...
CVE-2026-102779
The Joomla Extension by joomlafry.com (specifically TF Content versions 2.9.0 through 2.9.4 ) is vulnerable to the unauthenticated forced execution of published automation tasks. The root cause is that the extension exposes the site task records.custom_action without enforcing authentication , AC...
EUVD-2026-92473
Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task records.customaction without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token enforcement. A Guest can supply...
CVE-2026-102780 Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4
Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public RecordController. Its shared frontend save controller accepts the raw jform array, assigns...
CVE-2026-102780 Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4
Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public RecordController. Its shared frontend save controller accepts the raw jform array, assigns...
CVE-2026-102780
The TF Content extension for Joomla (versions 2.9.0 - 2.9.4 ) by joomlafry.com is vulnerable to unauthenticated cross-record publication and mass assignment . The root cause is that the public RecordController unconditionally authorizes both creation and editing actions. Additionally, the shared ...
EUVD-2026-92452
Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public RecordController. Its shared frontend save controller accepts the raw jform array, assigns...