4 matches found
EUVD-2026-65335
The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a direct request to the update or activa...
8.8CVSS5.5AI score0.00239EPSS
SaveExploits0References1
CVE-2026-75951
Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference multiple frontend/API actions in J-BusinessDirectory 6.2.3...
6.9CVSS0.00295EPSS
SaveExploits0References1
20