CVE-2026-48946

CVE-2026-48946 affects the K2 frontend Joomla extension (getk2.com) prior to version 2.26. The issue allows a K2 Author to upload a PHP file (e.g., shell.php) via the article-attachment upload path; Apache mod_php executes the file under the K2 web user, enabling arbitrary PHP code execution in t...

CVE-2019-19576

class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions...

PT-2019-15893

Name of the Vulnerable Software and Affected Versions class.upload.php versions 1.0.0 through 1.0.3 class.upload.php versions 2.0.0 through 2.0.4 Description The issue is related to the omission of .pht from the set of dangerous file extensions in class.upload.php, which is similar to a previousl...

Joomla! K2 2.8.0 Arbitrary File Download

Exploit Title: Joomla! Component K2 2.8.0 - Arbitrary File Download Dork: N/A Date: 26.02.2018 Vendor Homepage: http://www.joomlaworks.net/ Software Link: https://extensions.joomla.org/extensions/extension/authoring-a-content/content-construction/k2/ Software Download:...

Joomla K2 1.0.1b SQL Injection

---------------------------------------------------------------------- Joomla Component comk2 sectionid SQL injection Vulnerability ---------------------------------------------------------------------- + Author : Chip D3 Bi0s + Email : chipdebiosalt+64gmail.com + Group : LatinHackTeam +...