Coupon manager, 3.5

Coupon manager by joomla6teen.com, 3.5, SQL Injection...

[20260806] - Core - XSS through schema.org outputs

Improper escaping flags lead to an XSS vector in schema.org markup outputs...

[20260804] - Core - Improper ACL checks for custom fields webservice endpoints

An improper access check allows unauthorized users to create fields for inaccessible components...

[20260810] - Core - Unrestricted uploads of SHTML files

The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution...

[20260801] - Core - Response header injection in download views

Lack of output processing allowed a header injection in the multiple download views, leading to reflected file download / content-type confusion...

rsdirectory

Extension: RSDirectory! Version: Old 2.2.7 / New 2.2.8 Update details: Versions affected 1.0.0 through 2.2.7 Stored XSS allows remote authenticated attackers to inject arbitrary web script or HTML via the review reply component. Fixed in 2.2.8 Update URL:...

[20260807] - Core - MFA Authentication Bypass

Insufficient state checks lead to a vector that allows to bypass 2FA checks...

[20260805] - Core - Improper ACL checks for category webservice endpoints

An improper access check allows unauthorized users to create categories for inaccessible components...

[20260802] - Core - Improper CORS origin validation

An improper implementation prevented configured CORS origins from being properly validated in CORS requests...

GPS Tools v4.0.1,4.0.1,SQL Injection

GPS Tools v4.0.1,4.0.1,SQL Injection Developer release statement to the vel team https://www.corejoomla.com/news/1163-gps-tools-v4-0-2-is-released.html...

[20260808] - Core - Improper ACL checks for batch copy actions

An improper access check allows unauthorized users to perform copy batch operations on uneditable items...