CVE-2026-57827

CVE-2026-57827 — Componente RSFiles! de Joomla: RCE por subida de archivos no autenticada Bypass de subida por controlador dividido → Tarea de escritura directa → /downloads/shell.php → RCE Resumen CVE-2026-57827 es una vulnerabilidad de subida arbitraria de archivos no autenticada de severidad...

CVE-2026-57827

CVE-2026-57827 — RSFiles! Joomla Component Unauthenticated File Upload RCE Split-Controller Upload Bypass → Direct Write Task → /downloads/shell.php → RCE Overview CVE-2026-57827 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in RSFiles! comrsfiles, a widely...

joomla-cve-2018-6396

Joomla-CVE-2018-6396 Joomla! 组件 Google Map Landkarten PoC cve-2018-6396...

PageBuilderCK-CVE-2026-56290-Exploit

Page Builder CK — fonts.save RCE 探测工具 CVE-2026-56290 BlackHat Team 概念验证扫描器，用于 Joomla Page Builder CK 的 fonts.save 漏洞。 POC CVE-2026-56290 作者: @mrzblackhat 团队: BlackHat Team 鸣谢: Peyman Siyahi · MR.PERSIA 概述 此工具探测运行有漏洞的 compagebuilderck 组件的 Joomla 站点。它滥用 fonts.save 任务拉取远程负载，并将 webshell 写入：...

CVE-2026-56290

CVE-2026-56290 - Compagebuilderck 批量利用工具 ⚠️ 免责声明 本工具仅供教育和授权安全测试使用。 未经授权访问计算机系统是违法的 请仅在你拥有或明确允许测试的系统上使用此工具 作者不对因使用本工具造成的任何误用或损害负责 使用本工具即表示你同意遵守所有适用法律和法规 更多免责声明可查看 Jenderal92 封面上的声明。你可点击 这里 !!! 查阅 📋 描述 CVE-2026-56290 是一个针对 Compagebuilderck Joomla 组件的批量利用工具。此漏洞允许远程攻击者通过无限制文件上传机制上传任意 PHP...

CVE-2026-66917

JoomGallery 中因对象级授权失效导致的 IDOR + 存储型 XSS JoomGallery ≤ 4.3.0 — 编辑器角色用户可劫持任意相册图片并存储 XSS 载荷，从而实现管理员会话接管 摘要 JoomGallery 中的 UserimageController::save 检查的是 checkACL'edit', ...，而非 checkACL'edit.own', ...。拥有编辑器（Editor）角色的用户可以无视图片归属，向 task=userimage.save&id=N 发起 POST（IDOR — CWE-639）。由于编辑器角色全局拥有 core.edit...

Exploit for Unrestricted Upload of File with Dangerous Type in Rsjoomla Rsfiles\!

CVE-2026-57827 — RSFiles! Unauthenticated File Upload → RCE...

Exploit for Unrestricted Upload of File with Dangerous Type in Joomlack Page_Builder_Ck

CVE-2026-56290 - Compagebuilderck Mass Exploit ⚠️ Disclai...

CVE-2026-48908

A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code...

CVE-2019-25762

Joomla! Component JoomProject 1.1.3.2 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive user data by exploiting the projects endpoint. Attackers can send requests to index.php with option=comjpprojects&view=projects&tmpl=component&format=js...

CVE-2019-25755

Joomla Component vReview 1.9.11 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the cmId parameter. Attackers can send POST requests to the editReview task endpoint with URL-encoded SQL UNION...

CVE-2019-25752

Joomla! Component J-BusinessDirectory 4.9.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the type parameter. Attackers can send GET requests to index.php with the...

EUVD-2019-20197

Joomla! Component JoomCRM 1.1.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the dealid parameter. Attackers can send GET requests to index.php with option=comjoomcrm&view=contacts and inject SQL...

CVE-2019-25759

The CVE-2019-25759 entry describes an SQL injection in Joomla! component vbizz 1.0.7 where an authenticated attacker can craft the payid parameter to execute arbitrary SQL via POST to the employee management interface, potentially exposing database version and names. The provided sources confirm ...

CVE-2019-25759

Joomla! Component vBizz 1.0.7 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the payid parameter. Attackers can submit POST requests to the employee management interface with crafted payid array valu...

CVE-2019-25759 Joomla! Component vBizz 1.0.7 SQL Injection

Joomla! Component vBizz 1.0.7 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the payid parameter. Attackers can submit POST requests to the employee management interface with crafted payid array valu...

EUVD-2019-20195

Joomla! Component vBizz 1.0.7 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the payid parameter. Attackers can submit POST requests to the employee management interface with crafted payid array valu...

CVE-2019-25758

CVE-2019-25758 affects Joomla! component vBizz 1.0.7. The vulnerability is an unrestricted file upload in the profile_pic parameter, enabling authenticated attackers to upload arbitrary PHP files. By submitting malicious files via POST to the employee view endpoint, attackers can place PHP code i...

CVE-2019-25758 Joomla! Component vBizz 1.0.7 Remote Code Execution

Joomla! Component vBizz 1.0.7 contains an unrestricted file upload vulnerability that allows authenticated attackers to upload arbitrary PHP files by submitting malicious files through the profilepic parameter. Attackers can upload PHP files via POST requests to the employee view endpoint and...

CVE-2019-25756

CVE-2019-25756 affects Joomla! Component vAccount 2.0.2. The vulnerability is an SQL injection in the vaccount-dashboard/expense endpoint, where an unauthenticated attacker can inject payloads via the vid parameter to perform arbitrary SQL queries and exfiltrate sensitive data such as database ve...