64 matches found
CVE-2026-78070
SQL-инъекция через шорткод ORDER BY в plgcontentdpcalendar DPCalendar Free ≤ 10.11.2 — Пользователь уровня Author извлекает всю базу данных через time-based blind-инъекцию КРАТКОЕ ОПИСАНИЕ Контентный плагин plgcontentdpcalendar обрабатывает шорткоды events order="..."/events, встраиваемые в тело...
CVE-2026-21627---Tassos-Novarain-Framework-plg_system_nrframework-Exploit---Joomla
CVE-2026-21627 Неаутентифицированное произвольное включение файлов в фреймворке Novarain для Joomla nrframework Обзор Критическая уязвимость в плагине Tassos/Novarain Framework plgsystemnrframework для Joomla позволяет неаутентифицированным атакующим включать произвольные PHP-файлы на сервере,...
CVE-2020-13424
Titre de l'exploit: Joomla! Plugin XCloner Backup 3.5.3 - Inclusion de fichier local Authentifié Date: 2020-05-10 Exploit Author: Mehmet Kelepçe / Gais Cyber Security Exploit-Db Author ID: 8763 Reference: https://www.xcloner.com/xcloner-news/security-release-available-for-archived-joomla-version/...
CVE-2026-57829
Helix Ultimate Framework — XSS stocké non authentifié comajax → Détournement de session administrateur → Prise de contrôle totale du compte Ceci est le résultat le plus important de ce dossier de recherche — CRITIQUE, entièrement confirmé de bout en bout. Contrairement au bogue de suppression...
CVE-2026-49049
CVE-2026-49049 — Helix3 JoomShaper Joomla Scanner RCE AJAX non authentifié Scanner / vérificateur de masse pour CVE-2026-49049 : gestionnaire AJAX non authentifié dans le plugin Helix3 Framework pour Joomla v1.0 – 3.1.0 , corrigé dans 3.1.1+. Tests autorisés uniquement. Utilisez uniquement sur de...
CVE-2020-15399
Название эксплойта: Joomla! J2 JOBS 1.3.0 - 'sortby' Аутентифицированная SQL-инъекция Дата: 2020-06-17 Автор эксплойта: Mehmet Kelepçe / Gais Cyber Security Сайт вендора: https://joomsky.com/ Ссылка на ПО: https://joomsky.com/products/js-jobs-pro.html Журнал изменений обновление :...
CVE-2026-78074 Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions
Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions - a missing authentication check allows unauthenticated actors to delete arbitrary installed extensions. Only the free versions of the miniOrange plugins are affected...
CVE-2026-66915 Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Remote code execution in Fabrik 4.7.2 - An unauthenticated attacker could execute arbitrary code by using the ajaxcalc feature of the calc plugin...
Exploit for Improper Access Control in Ollyo Helix3
CVE-2026-49049 — Helix3 JoomShaper Joomla Unauthenticated AJ...
Exploit for Improper Access Control in Ollyo Helix3
CVE-2026-49049 — Helix3 Joomla Plugin JoomShaper Unauthenticat...
EUVD-2026-40122
The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters...
EUVD-2026-15653
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RSJoomla! RSFirewall! rsfirewall allows Stored XSS.This issue affects RSFirewall!: from n/a through = 1.1.45...
CVE-2026-21627 Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomla
The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s comajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction...
CVE-2026-21627
The CVE concerns the Tassos Framework plugin (Joomla) versions 4.10.14 through 6.0.37, where specific AJAX handling via Joomla com_ajax can invoke internal framework functionality without proper restrictions. This leads to a SQL injection and an unauthenticated file read, driven by how the plugin...
CVE-2010-0635
SQL injection vulnerability in the plgSearchEventsearch::onSearch method in eventsearch.php in the JEvents Search plugin 1.5 through 1.5.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: some of these details are obtained from third party...
EUVD-2010-0785
Malware in sbrugna...
EUVD-2023-32370
Malicious code in bioql PyPI...
EUVD-2023-32369
Malicious code in bioql PyPI...