CVE-2026-56291

CVE-2026-56291 — Balbooa Forms Joomla Mass RCE Exploit Pre-Auth form.uploadAttachmentFile → No CSRF → PHP Upload Overview CVE-2026-56291 is a critical CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Balbooa Forms combaforms Joomla extension 2.4.1. The form.uploadAttachmentFile...

CVE-2019-15120

CVE-2019-15120 Exploit per XSS tramite BBCode sull'estensione Kunena precedente alla 5.1.14 per Joomla! Informazioni Descrizione: Nell'estensione Kunena precedente alla 5.1.14 per Joomla!, è possibile per qualsiasi utente eseguire un attacco XSS persistente inviando un messaggio speciale in...

CVE-2023-27842

CVE-2023-27842 eXtplorer 2.1.15 – Permessi insicuri dopo Esecuzione di Codice Remoto Autenticato Homepage del fornitore: http://extplorer.net/ Link del software: http://extplorer.net/attachments/download/99/eXtplorer2.1.15.zip Versione: 2.1.15 Installazione root@kitploit: git clone...

CVE-2026-48908-by-yora

🔐 CVE-2026-48908 Scanner & Safe PoC Joomla SP Page Builder — Unauthenticated File Upload / Potential RCE Developed byyora 📌 About This project is a security research and vulnerability detection tool developed by yora to help identify CVE-2026-48908 affecting SP Page Builder for Joomla. The...

CVE-2026-65761

CVE-2026-65761 - Proof-of-concept di SQL injection su EasyStore Pro tramite filtersortby Questo repository fornisce una prova di concetto educativa per CVE-2026-65761, una vulnerabilità di SQL injection non autenticata che interessa le versioni da 1.0.0 a 2.0.2 incluse dell'estensione Joomla...

CVE-2026-78073

Joomla Extension - mrvinoth.com - Reflected XSS in All Video Share 1.0.0-4.5.0 - Various user supplied inputs lacked escaping, leading to reflected XSS vectors...

CVE-2026-78071

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

CVE-2026-78072

Joomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded 5.6.1...

CVE-2026-78070

Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2 - Saving an article can trigger a blind SQL injection with content plugin, needs update permission for articles...

CVE-2026-78071 Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

CVE-2026-78071 Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

CVE-2026-78071

DP Calendar is a Joomla extension by digital-peak.com. Versions 7.0.0 through 10.11.2 are affected by an authenticated, privileged stored XSS . The root cause is that the location title is rendered in a data attribute without proper escaping. Exploitation requires an authenticated user with the c...

EUVD-2026-67653

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

CVE-2026-78073 Joomla Extension - j2commerce.com - Reflected XSS attribute in All Video Share 1.0.0-4.5.0

Joomla Extension - mrvinoth.com - Reflected XSS in All Video Share 1.0.0-4.5.0 - Various user supplied inputs lacked escaping, leading to reflected XSS vectors...

EUVD-2026-67652

Joomla Extension - mrvinoth.com - Reflected XSS in All Video Share 1.0.0-4.5.0 - Various user supplied inputs lacked escaping, leading to reflected XSS vectors...

CVE-2026-78073 Joomla Extension - j2commerce.com - Reflected XSS attribute in All Video Share 1.0.0-4.5.0

Joomla Extension - mrvinoth.com - Reflected XSS in All Video Share 1.0.0-4.5.0 - Various user supplied inputs lacked escaping, leading to reflected XSS vectors...

CVE-2026-78073

All Video Share (Joomla extension by mrvinoth.com, versions 1.0.0–4.5.0 ) is vulnerable to reflected XSS caused by various user-supplied inputs lacking proper escaping. The vulnerability allows an attacker to inject malicious scripts that execute in a victim's browser upon clicking a crafted link...

CVE-2026-78072 Joomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded < 5.6.1

Joomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded 5.6.1...

CVE-2026-78072 Joomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded < 5.6.1

Joomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded 5.6.1...

CVE-2026-78072

CVE-2026-78072 affects the Joomla extension Sexy Polling Reloaded by Jefferson49 , in versions earlier than 5.6.1 . The vulnerability is an unauthenticated blind SQL injection , meaning a remote attacker with no privileges or user interaction can exploit it over the network with low complexity. T...