Joomla-3.4.6---configuration.php-Remote-Code-Execution

Joomla-3.4.6---configuration.php-Remote-Code-Execution Affected versions: 3.0.0-3.4.6 1. Vulnerability verification python3 Joomla-3.4.6-RCE.py -t http://172.20.10.4 If "Vulnerable" is displayed, the vulnerability exists. python3 test.py -t http://127.0.0.1:8080/ --exploit --lhost 192.168.31.126...

CVE-2026-108828

A vulnerability was identified in Zen Cart 2.2.2. Affected by this vulnerability is the function eval of the file admin/configuration.php of the component Admin Panel. The manipulation of the argument gID leads to sql injection. The attack may be initiated remotely. The attack is considered to ha...

EUVD-2026-97335

A vulnerability was identified in Zen Cart 2.2.2. Affected by this vulnerability is the function eval of the file admin/configuration.php of the component Admin Panel. The manipulation of the argument gID leads to sql injection. The attack may be initiated remotely. The attack is considered to ha...

CVE-2026-108828 Zen Cart Admin Panel configuration.php eval sql injection

A vulnerability was identified in Zen Cart 2.2.2. Affected by this vulnerability is the function eval of the file admin/configuration.php of the component Admin Panel. The manipulation of the argument gID leads to sql injection. The attack may be initiated remotely. The attack is considered to ha...

CVE-2026-108828

A SQL injection vulnerability exists in Zen Cart 2.2.2 within the Admin Panel component. The flaw resides in the eval function of the admin/configuration.php file, where manipulation of the gID argument allows for remote attack initiation. While the attack is considered to have high complexity an...

CVE-2026-108828: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in Zen Cart 2.2.2. Affected by this vulnerability is the function eval of the file admin/configuration.php of the component Admin Panel. The manipulation of the argument gID leads to sql injection. The attack may be initiated remotely. The attack is considered to ha...

Exploit for CVE-2026-97161

CVE-2026-97161 — UP Plugin Path Traversal / File Read Joomla...

CVE-2026-94131

Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as...

CVE-2026-94131

The AcyMailing Enterprise extension for Joomla (versions

CVE-2026-94131 Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0

Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as...

CVE-2026-94131 Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0

Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as...

PT-2026-99393

Name of the Vulnerable Software and Affected Versions AcyMailing Enterprise versions prior to 11.1.0 Description An unauthenticated arbitrary file deletion issue exists where a subscriber can store a file path within a file-type custom field. When this field is cleared, the system may delete the...

PT-2026-99395

Name of the Vulnerable Software and Affected Versions UP plugin versions 5.0.0 through 5.2.0 UP plugin versions 6.0.0 through 6.0.29 UP plugin versions prior to 6.1.0 Description An authenticated, privileged PHP command injection exists in the UP plugin extension. Additionally, an unauthenticated...

CVE-2026-90905

Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=comeasystore&task=appconfig.updateConfiguration updated core Joomla mail configuration fromname, mailfrom in...

CVE-2026-90905

The Easy Store Joomla extension (versions 1.0.0-3.0.0 ) by joomshaper.com is vulnerable to a Cross-Site Request Forgery (CSRF) and a lack of Access Control on the administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration endpoint. The root cause is the failure to verify anti...

CVE-2026-90905 Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0

Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=comeasystore&task=appconfig.updateConfiguration updated core Joomla mail configuration fromname, mailfrom in...

CVE-2026-90905 Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0

Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=comeasystore&task=appconfig.updateConfiguration updated core Joomla mail configuration fromname, mailfrom in...

EUVD-2026-85556

Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=comeasystore&task=appconfig.updateConfiguration updated core Joomla mail configuration fromname, mailfrom in...

CVE-2026-90905: Cross-Site Request Forgery (CSRF)

Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=comeasystore&task=appconfig.updateConfiguration updated core Joomla mail configuration fromname, mailfrom in...

PT-2026-97517

Name of the Vulnerable Software and Affected Versions Easy Store versions 1.0.0 through 3.0.0 Description The 'administrator/index.php?option=com easystore&task=appconfig.updateConfiguration' endpoint allows the update of core Joomla mail configuration in the configuration.php file without...