CVE-2019-15120

CVE-2019-15120 Эксплойт для XSS через BBCode в расширении Kunena до версии 5.1.14 для Joomla! Информация Описание: В расширении Kunena до версии 5.1.14 для Joomla! любой пользователь может выполнить атаку stored XSS, отправив специальное сообщение в любое поле с поддержкой BBcode. В результате...

CVE-2023-27842

CVE-2023-27842 eXtplorer 2.1.15 – Небезопасные разрешения, ведущие к удаленному выполнению кода с аутентификацией Домашняя страница разработчика: http://extplorer.net/ Ссылка на программное обеспечение: http://extplorer.net/attachments/download/99/eXtplorer2.1.15.zip Версия: 2.1.15 Установка git...

CVE-2026-102783

Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox 2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site UploaderHelper . The showImage action resolves a request-controlled path, calls that helper, and then returns the image. If image decoding is...

CVE-2026-102784 Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0

Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST. addLanguage does not require POST inside the action and reads url and zip through the generic request...

CVE-2026-56291

CVE-2026-56291 — массовый эксплойт RCE для Balbooa Forms Joomla Без аутентификации form.uploadAttachmentFile → Без CSRF → Загрузка PHP Обзор CVE-2026-56291 — это критическая CVSS 9.8 уязвимость неаутентифицированной произвольной загрузки файлов в расширении Joomla Balbooa Forms combaforms CISA KE...

CVE-2026-76565

Отражённый XSS через параметры фильтра pricefrom / priceto в PhocaCart PhocaCart ≤ 6.1.7 — неаутентифицированный злоумышленник внедряет произвольный JavaScript через специально сформированный URL фильтра цены СВОДКА PhocaCart 6.1.7 для Joomla уязвим к отражённому межсайтовому скриптингу XSS через...

CVE-2024-5736

CVE-2024-5736 Расширение AdmirorFrames для Joomla! 5.0 - Подделка серверных запросов SSRF Хронология Уязвимость сообщена вендору: 26.01.2024 Выпущена исправленная версия 5.0: 06.06.2024 Публичное раскрытие: 28.06.2024 Описание Подделка серверных запросов Server-Side Request Forgery в расширении...

CVE-2026-102777

The Joomla Extension - svenbluege.de Event Gallery extension (versions

CVE-2026-102777 Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0

Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension 6.6.0 - The Google Photos picker of the back-end upload page fetches the thumbnails of the picked images through the server, with the OAuth access token of the Google Photos...

CVE-2026-102777 Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0

Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension 6.6.0 - The Google Photos picker of the back-end upload page fetches the thumbnails of the picked images through the server, with the OAuth access token of the Google Photos...

CVE-2026-102778 Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0

Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension 6.6.0 - The page a shared image link opens the share mini page of the front end can link the article the image was shared from when the option "Share article links" is on. I...

CVE-2026-102778

The Joomla Extension - svenbluege.de (Event Gallery extension) is vulnerable to Cross-Site Scripting (XSS) and Open Redirect in versions prior to 6.6.0 . When the "Share article links" option is enabled, the share mini page takes the article address from a shared link and prints it into the page ...

CVE-2026-102776

The Joomla Extension - svenbluege.de 's Event Gallery extension (versions

EUVD-2026-92451

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...

CVE-2026-102776 Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...

CVE-2026-102776 Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...

PT-2026-106012

🚨 CVE-2026-102778 Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension 6.6.0 - The page a shared image link opens the share mini page of the front end can link the article the image was shared from when the option "Share artic...

PT-2026-106011

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...

CVE-2024-5735

CVE-2024-5735 Расширение AdmirorFrames для Joomla! params'templatesBASE' = JPATHBASE . DIRECTORYSEPARATOR . 'plugins' . DIRECTORYSEPARATOR . 'content' . $path . 'templates' . DIRECTORYSEPARATOR; Эта проблема была вызвана прямым использованием переменной JPATHBASE при построении пути к изображению...

CVE-2024-5737

CVE-2024-5737 AdmirorFrames Joomla! Extension : $height=0x3c; $im = imagecreate$width, $height; $hex=unpack'H',$payload; $chunks=strsplit$hex1, 6; for$i=0; $i count$chunks; $i++ $colorchunks=strsplit$chunks$i, 2;...