Search
Search Results (29 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-64796 | 1 Regularlabs.com | 1 Sourcerer Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured include folder, and executable script/style variants could bypass detection. | ||||
| CVE-2026-63280 | 1 Regularlabs.com | 4 Advanced Module Manager Extension For Joomla, Conditional Content Extension For Joomla, Content Templater Pro Extension For Joomla and 1 more | 2026-07-23 | N/A |
| Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager - Conditions administration did not consistently enforce tokens and component/mapped-item permissions. | ||||
| CVE-2026-63685 | 1 Regularlabs.com | 1 Db Replacer Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension - Administrator routes and replacement requests did not consistently require Super User permission and a valid token. An unauthorized backend user or CSRF attack could perform database replacements, potentially causing major data corruption or site compromise. | ||||
| CVE-2026-63265 | 1 Regularlabs.com | 23 Advanced Module Manager Extension For Joomla, Articles Anywhere Extension For Joomla, Articles Field Extension For Joomla and 20 more | 2026-07-23 | N/A |
| Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints - Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization. | ||||
| CVE-2026-64797 | 1 Regularlabs.com | 1 Ip Login Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and potentially impersonate mapped accounts. | ||||
| CVE-2026-65756 | 1 Regularlabs.com | 1 Keyboard Shortcuts Extension For Joomla | 2026-07-23 | 6.1 Medium |
| Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript. | ||||
| CVE-2026-64876 | 1 Regularlabs.com | 1 Geoip Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension - Database-update requests lacked consistent token and Super User checks, this could cause unauthorized updates. | ||||
| CVE-2026-65754 | 1 Regularlabs.com | 1 Rereplacer Pro Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory. | ||||
| CVE-2026-65755 | 1 Regularlabs.com | 2 Articles Anywhere Extension For Joomla, Users Anywhere Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension - Date-sensitive query cache keys did not retain a bounded time component. Cached results could remain active across future publication or expiry boundaries, potentially exposing content after it should become unavailable. | ||||