59 matches found
CVE-2026-49049
CVE-2026-49049 — Helix3 JoomShaper Joomla Unauthenticated AJAX RCE Scanner Mass scanner / verifier for CVE-2026-49049 : unauthenticated AJAX handler in the Helix3 Framework plugin for Joomla v1.0 – 3.1.0 , patched in 3.1.1+. Authorized testing only. Use only on systems you own or have written...
CVE-2020-15399
Exploit Title: Joomla! J2 JOBS 1.3.0 - 'sortby' Authenticated SQL Injection Date: 2020-06-17 Exploit Author: Mehmet Kelepçe / Gais Cyber Security Vendor Homepage: https://joomsky.com/ Software Link: https://joomsky.com/products/js-jobs-pro.html Change Log Update :...
CVE-2026-78070
SQL Injection via ORDER BY Shortcode in plgcontentdpcalendar DPCalendar Free ≤ 10.11.2 — Author-level User Extracts Full Database via Time-Based Blind Injection SUMMARY The plgcontentdpcalendar content plugin parses events order="..."/events shortcodes embedded in Joomla article bodies. The order...
CVE-2026-21627---Tassos-Novarain-Framework-plg_system_nrframework-Exploit---Joomla
CVE-2026-21627 Unauthenticated Arbitrary File Inclusion in Joomla's Novarain Framework nrframework Overview A critical vulnerability in the Tassos/Novarain Framework plgsystemnrframework Joomla plugin allows unauthenticated attackers to include arbitrary PHP files on the server, instantiate...
CVE-2020-13424
Exploit Title: Joomla! Plugin XCloner Backup 3.5.3 - Local File Inclusion Authenticated Date: 2020-05-10 Exploit Author: Mehmet Kelepçe / Gais Cyber Security Exploit-Db Author ID: 8763 Reference: https://www.xcloner.com/xcloner-news/security-release-available-for-archived-joomla-version/ Vendor...
CVE-2026-57829
Helix Ultimate Framework — Unauthenticated Stored XSS comajax → Admin Session-Riding → Full Account Takeover This is the strongest finding in this research folder — CRITICAL, fully confirmed end-to-end. Unlike the delete-only bug in helixultimatedeletepoc.md, this one has a real, working path to...
CVE-2026-78074 Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions
Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions - a missing authentication check allows unauthenticated actors to delete arbitrary installed extensions. Only the free versions of the miniOrange plugins are affected...
CVE-2026-66915 Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Remote code execution in Fabrik 4.7.2 - An unauthenticated attacker could execute arbitrary code by using the ajaxcalc feature of the calc plugin...
EUVD-2026-40122
The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters...
EUVD-2026-15653
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RSJoomla! RSFirewall! rsfirewall allows Stored XSS.This issue affects RSFirewall!: from n/a through = 1.1.45...
CVE-2026-21627 Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomla
The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s comajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction...
CVE-2026-21627
The CVE concerns the Tassos Framework plugin (Joomla) versions 4.10.14 through 6.0.37, where specific AJAX handling via Joomla com_ajax can invoke internal framework functionality without proper restrictions. This leads to a SQL injection and an unauthenticated file read, driven by how the plugin...
CVE-2010-0635
SQL injection vulnerability in the plgSearchEventsearch::onSearch method in eventsearch.php in the JEvents Search plugin 1.5 through 1.5.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: some of these details are obtained from third party...
EUVD-2010-0785
Malware in sbrugna...
EUVD-2023-32369
Malicious code in bioql PyPI...
EUVD-2023-32370
Malicious code in bioql PyPI...
EUVD-2025-21872
Malicious code in bioql PyPI...
EUVD-2023-32371
Malicious code in bioql PyPI...
