CVE-2019-19576

CVE-2019-19576 concerns verot.net’s class.upload.php (versions < 1.0.3 and

CVE-2018-7482

The K2 component 2.8.0 for Joomla! contains an Incorrect Access Control vulnerability involving directory traversal . This flaw allows an attacker to download arbitrary files by exploiting the connector task via a crafted request (e.g., using a base64 encoded path in the target parameter). While ...

CVE-2019-19634

CVE-2019-19634 affects verot.net class.upload.php up to version 2.0.4 (and 1.0.3 in some builds) used in Joomla! K2 extension; it omits .pht from dangerous extensions, enabling arbitrary file upload and remote code execution. An exploit/POC demonstrates obtaining a shell via a crafted image uploa...

CVE-2026-48941

The K2 extension for Joomla (versions

CVE-2026-48946

The K2 extension for Joomla (versions

CVE-2026-48940

The K2 extension for Joomla (versions < 2.26) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. A user with "create item" rights (typically the Author tier) can submit an article containing a raw [removed] tag within the embedVideo POST field. The extension stores this input verbatim ...

CVE-2026-48942

The K2 extension for Joomla (versions ≤ 2.26) is vulnerable to Stored-XSS because it renders the #__k2_users.image column directly into HTML src attributes across two distinct templates. The root cause is the lack of HTML escaping during this rendering process. While the CVSS score reflects a Med...

CVE-2026-48944

The K2 extension for Joomla (versions

CVE-2026-48945

The K2 extension for Joomla (versions < 2.26) is vulnerable to Privileged RCE due to an unrestricted file upload path in the article gallery. The system accepts zip or tar archives and extracts them to /media/k2/galleries//. While it renames specific image formats (gif, jpg, jpeg, png, webp), ...

CVE-2026-48943

The K2 extension (version ≤ 2.24 ) for Joomla is vulnerable to a mass-assignment defect within the plg_user_k2 system user plugin. A Registered Joomla user can exploit this by including the K2UserForm=1 field in a standard com_users profile.save POST request. This action allows the user to write ...