Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-105604

Unauthenticated SQL Injection in Joomla DJ-Classifieds < 3.11.3

CVSS 4.0
9.3 critical
EPSS
—
Published
·
Modified
Analyze CVE-2026-105604 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

The Joomla extension DJ-Classifieds contains an unauthenticated SQL injection flaw in its frontend search. Attackers trigger it via crafted search requests over the network with no authentication or user interaction required. This grants database read/write access. Affected are installations of DJ-Classifieds before version 3.11.3.

What to do: Upgrade DJ-Classifieds to 3.11.3 or later from dj-extensions.com. No workaround provided.

ProductAffected
dj-extensions.com DJ-Classifieds< 3.11.3
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated SQL injection vector in the frontend search.

Ecosystems
Joomla
Weakness
CWE-89
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD CVE.org GitHub PoCs EPSS (—)

In the news

0 stories

No ingested article mentions this CVE yet.