Vulnerabilities

Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.1 - The TUS endpoint allows arbitrary file uploads, however neither file name nor file extension are under attacker control. Code execution requires non-standard server configuration.

Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A crafted link to the paypal notify endpoint, if followed by a victim's browser (or an automated system that fetches it), causes the resulting redirect to `com_j2store`'s checkout controller to carry attacker-chosen query parameters instead of only the intended `view=checkout&task=confirmPayment&orderpayment_type=...&paction=process` set — parameter injection/smuggling into that follow-up request. This requires a victim to load the crafted link (`UI:R`/`UI:P`); it does not by itself grant an unauthenticated attacker anything they could not already obtain by requesting the target `com_j2store` URL directly with their own parameters.

Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who obtains the site's Joomla `secret` can compute a valid access token for *any* order on the site without ever having placed one, gaining guest access to that order's details and any purchased digital downloads. Because the token is never rotated, this exposure persists indefinitely even after the underlying secret-disclosure vector is patched, unless the Joomla secret itself is also rotated. The attack complexity (`AC:H`) is high because it depends on the secret already being known through a separate vector; it is not directly exploitable by an anonymous visitor with no other foothold.

J2Store, a Joomla e-commerce extension from j2commerce.com, contains an unauthenticated flaw in its order-status handling: an attacker who can reach the storefront can send a crafted status-update request for any order without authenticating or supplying valid payment or transaction data. The impact is a denial of service against the order pipeline — pending orders can be mass-flipped to FAILED to disrupt revenue and force manual reprocessing, and already-fulfilled orders can be reverted to FAILED, triggering unwarranted refunds, cancellations, and customer-support load. The root cause maps to CWE-472 (trust of assumed-immutable web parameters) and CWE-602 (client-side/server-side enforcement mismatch) on the order-status update flow. Every released version is affected — 1.0.0-3.3.2, 4.0.0-4.0.22, and 4.1.0-4.1.7 — earning a CVSS 4.0 score of 8.7 (high), though with no integrity impact beyond order state. Exploitation status: no public PoC and no known in-the-wild attacks, but the flaw is trivially discoverable by anyone probing a Joomla store.

Do: Update J2Store to a release newer than the affected ranges — i.e., beyond 4.1.7 on the current line, or the latest available build for sites still on the 3.x/4.0.x branches — since all prior versions are vulnerable. Audit order history for unexplained FAILED transitions and reconcile order states against payment-gateway records before issuing any refunds or cancellations. Until patched, apply a WAF rule or rate limit to block and log unauthenticated requests hitting order-status update endpoints.

J2Store, a Joomla e-commerce extension from j2commerce.com, builds the on-disk path for purchased digital downloads in J2StoreModelOrderdownloads::getFilePath() by concatenating the configured attachment folder with the stored product_file_save_name, applying only JPath::clean() — which normalizes separators but does not reject ../ segments — and never verifying the resolved path stays inside the attachment folder. When a customer triggers a download via task=download for a product file whose saved name contains a ../ traversal sequence, the path resolves outside the attachment folder and the requester can download any file readable by the web server, such as configuration.php containing database credentials and the Joomla secret. The traversal string is most plausibly injected through the CSRF-forgeable admin product-file save actions, so an attacker needs no server compromise to plant it, and a valid token/pid pair can be obtained by simply purchasing the product. Affected deployments are Joomla sites running J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, or 4.1.0-4.1.7 that use the digital downloads feature. There is no public PoC, no known in-the-wild exploitation, and the CVE is not in CISA's KEV catalog.

Do: Upgrade J2Store to a build newer than the affected ranges (later than 3.3.2 on the 3.x branch, later than 4.0.22 on 4.0.x, or later than 4.1.7 on 4.1.x), which resolves and confines the download path to the attachment folder. Audit stored product_file_save_name values in the product-files table for ../ segments and review web server access logs for task=download requests containing traversal sequences. If configuration.php may have been read, rotate the database credentials and the Joomla secret and invalidate all active sessions.

J2Store, a widely used e-commerce extension for Joomla from j2commerce.com, contains an unauthenticated blind SQL injection flaw in the storefront product list, reachable on any public shop that exposes the standard product listing or product-tags filter. An attacker with no account can craft malicious filter/listing requests and use boolean- or time-based inference to slowly extract arbitrary database content, including customer records, order data, and stored credentials or tokens. All shops running J2Store versions 1.0.0-3.3.2, 4.0.0-4.0.22, or 4.1.0-4.1.7 are affected because the vulnerable endpoint sits on the public-facing storefront, requiring no authentication or user interaction. The issue is rated high severity (CVSS 4.0: 8.7) with high impact on confidentiality of the shop database. No public proof-of-concept exists, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported as of this analysis.

Do: Upgrade J2Store immediately to a release outside the affected ranges (later than 4.1.7, or a patched build of your current branch). Until patched, apply WAF rules that filter SQL metacharacters on the product-list and product-tags filter parameters, and verify that the database account used by Joomla has least-privilege access. Review web server and database logs for anomalous, repetitive or slow-responding requests to storefront product listing/filter URLs as signs of blind SQL injection probing, and rotate any credentials, tokens, or secrets stored in the database if compromise is suspected.

J2Store, a Joomla e-commerce extension from j2commerce.com, ships its cart, checkout, and myprofile controllers without CSRF token checks, so a forged cross-site request can ride a victim's active session and silently overwrite the billing or shipping address before order confirmation — potentially redirecting a paid order's goods to an attacker-controlled address — or tamper with a saved profile address via saveAddress(). The attack requires user interaction (the victim must encounter attacker-controlled content while logged in), but needs no privileges and executes with the victim's own session rights, so there is no cross-account data access. The flaw is rated high severity (CVSS 4.0: 7.1, primarily an integrity impact). Every release of the product is affected: 1.0.0–3.3.2, 4.0.0–4.0.22, and 4.1.0–4.1.7. No public proof of concept exists and no in-the-wild exploitation has been observed.

Do: Upgrade every J2Store installation to the latest available release, which is newer than the affected ranges (beyond 4.1.7, 4.0.22, and 3.3.2 respectively). As an interim mitigation, enforce SameSite=Lax or Strict on session cookies (the 'cookie_samesite' setting on Joomla 4+) to blunt cross-site forgeries, and review recent orders for shipping or billing address changes made late in checkout that differ from the customer's saved profile.

Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 6.9.0 - In the ajax_contact, optin_form and form_builder addons, the result returned by the CAPTCHA plugin's onCheckAnswer event was discarded and replaced with a test for a non-empty string whenever the request-supplied view_type parameter equalled module. Submitting view_type=module together with any arbitrary token value therefore passed verification. This affected every instance of these addons placed inside an SP Page Builder module, irrespective of the CAPTCHA type configured for the site, and the view_type parameter was never validated against the context in which the form was actually rendered.

Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The add-to-menu routine invoked the com_menus item model's save() method directly. That model does not perform authorisation itself, because the relevant checks reside in the com_menus controller, and the only check applied was core.edit on com_sppagebuilder. Users with no permissions whatsoever on com_menus could therefore create menu items, and because the record identifier was taken from the submitted jform[menuid] field, could also overwrite existing ones. The home flag was read back from the database and preserved, so the site's home menu item could be repointed while remaining the home item.

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The folder request parameter replaced the generated date-based destination folder in its entirety and was then passed to Folder::create() and File::upload() without either of the directory boundary checks applied elsewhere in the same file. Files could be written into any directory beneath the web root, including administrator/, templates/, cli/ and the site root. Joomla's PATH input filter prevented traversal above the web root, and existing files were not overwritten.

SP Page Builder (Free and Pro) versions 4.0.0 through 6.9.0 suffer a path traversal flaw (CWE-22) in the media rename task: unlike the folder operations in the same controller, it applied no directory boundary checks, and its validation only required that a media record exist for the supplied identifier OR that the supplied path exist in the #__spmedia table rather than both, so the identifier and the filesystem path were never checked against each other while the STR input filter left traversal sequences intact. An authenticated attacker with high privileges (CVSS 4.0 base score 7.0, AV:N/PR:H) can pair any valid media identifier with an unrelated path and rename arbitrary files elsewhere in the Joomla installation — including renaming configuration.php to take the site offline. Affected deployments are Joomla sites running SP Page Builder 4.0.0–6.9.0 in either the Free or Pro edition. No public proof of concept is known, the CVE is not on the CISA KEV list, and no exploitation in the wild has been reported.

Do: Upgrade SP Page Builder (Free and Pro) to a release newer than 6.9.0, ideally the latest version available from joomshaper.com. Until patched, restrict access to the SP Page Builder media manager to trusted administrators only, since exploitation requires high privileges. Check the #__spmedia table, server access logs, and the Joomla root directory for evidence of rename operations targeting files outside the media folder — especially a missing or renamed configuration.php.

Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-Controlled CAPTCHA Configuration in SP Page Builder Pro 5.1.4 - 6.9.0 - The optin_form addon read the CAPTCHA type, the expected answer and the enabled flag from the request rather than from the stored addon configuration. Verification reduced to md5($captcha_question) != $captcha_answer with both operands supplied by the attacker, so any value passed.

The content plugin shipped with JoomShaper SP Page Builder (Free and Pro) versions 5.2.1 through 6.9.0 contains an authenticated SQL injection in plgContentSppagebuilder::onContentAfterSave(): the jform[attribs][sppagebuilder_article_id] value from the request is concatenated directly into a WHERE view_id = ... clause querying #__sppagebuilder, with no quoting or type casting. Because Joomla's ARRAY input filter returns the array with element values untouched, the entire payload can be delivered in a single POST field, and because the vulnerable block executes before the com_content.article context test, it runs on every onContentAfterSave event regardless of which component triggered the save. An authenticated user with privileges sufficient to trigger a content save (CVSS 4.0: 8.6 high, PR:H) can exploit this as time-based blind SQL injection to read arbitrary database contents, including the #__users and #__session tables, enabling credential-hash and session-token theft and full site compromise. Any Joomla site running SP Page Builder Free or Pro 5.2.1–6.9.0 with the content plugin enabled is affected, including sites that received the extension bundled with JoomShaper templates. No public proof-of-concept exists, no exploitation in the wild has been reported, and the flaw is not on the CISA KEV list.

Do: Update SP Page Builder (Free and Pro) to the latest release, which is newer than 6.9.0 and contains the fix. If patching must be deferred, disable the SP Page Builder content plugin (plgContentSppagebuilder) where it is not needed and restrict content-authoring privileges (Author level and above) to fully trusted users, since exploitation requires an authenticated, privileged trigger. Review logs for POST requests carrying jform[attribs][sppagebuilder_article_id] with non-numeric or oversized values, and audit #__users and #__session for signs of extraction such as unexpected administrator accounts or hijacked sessions.

Regular Labs Modals Pro for Joomla, in all versions before 17.0.0, contains a privileged stored cross-site scripting (XSS) flaw because its documented JavaScript event-handler feature (such as on-open and on-closed) is not restricted to trusted extension configuration. An authenticated attacker holding only author-level privileges can embed executable event code in ordinary article content, and that script then runs in the browser of any user — including a site administrator — who views the page. Successful exploitation gives the attacker script execution in a higher-privileged user's session, which can be leveraged for administrative actions such as content tampering, further account compromise, or site takeover. Sites running Modals Pro below 17.0.0 that allow non-trusted users to author articles are the most exposed; only the third-party extension is affected, not Joomla core. There is no evidence of exploitation in the wild, no public proof of concept, and the CVE is not on CISA's Known Exploited Vulnerabilities catalog.

Do: Upgrade Modals Pro to version 17.0.0 or later, where the event-handler feature is reserved for trusted extension configuration. Until then, restrict article authoring to fully trusted staff and review existing articles for {modal} tags containing on-open/on-closed or other event attributes from untrusted contributors. Also audit author-level user accounts for suspicious or unauthorized registrations, since the flaw requires an authenticated author account to exploit.

Regular Labs Snippets for Joomla contains a stored cross-site scripting (XSS) flaw in how the extension substitutes variable values supplied through article tags into saved Snippet content. Because affected versions do not check the article author's trust level, a lower-privileged author can inject an unsafe value — for example via the url option — into a security-sensitive position in content designed by a trusted Snippet author. Successful exploitation causes the attacker's script to execute in the browsers of site visitors or higher-privileged users such as administrators, enabling cookie/session theft or malicious actions taken as the victim. The affected products are Snippets Free for Joomla before 7.0.0 and Snippets Pro for Joomla before 11.0.0, rated high severity (CVSS 4.0: 7.5) with the attack requiring attacker preparation and author-level privileges. The flaw is not in CISA's KEV catalog, and no public proof of concept or observed in-the-wild exploitation is known.

Do: Upgrade Snippets Free to version 7.0.0 or later, and Snippets Pro to version 11.0.0 or later. Audit articles authored by low-privilege users for Snippet tags containing unexpected url or variable values, and review site logs for injected script payloads. Until patched, consider restricting authoring permissions or Snippet usage to trusted users only.

Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla < 20.0.0, Users Anywhere extension for Joomla < 2.1.0 - Articles Anywhere Pro and Users Anywhere Pro return values from request-input data tags without making them safe for the context in which the tag is used. Joomla's string input filter does not make the same value safe for HTML text, an HTML attribute and a URL. A visitor-controlled request value can therefore become an executable URL or a new event attribute in output configured by a site author.

Articles Anywhere, a Joomla content plugin from Regular Labs (regularlabs.com), contains a privileged stored cross-site scripting flaw (CVSS v4.0 7.5) in versions before 20.0.0: it accepts link options such as onclick and onmouseover and renders them as real HTML event attributes without checking the article author's trust level. An attacker with at least Joomla Author-level permissions can embed these options in the plugin's tag inside an article, and the malicious syntax survives Joomla's normal Author content filter because the executable HTML is only generated later, when the page is rendered. When a victim — potentially an administrator viewing the article in the backend — loads the affected page, the injected event handler executes attacker-controlled JavaScript in their session, enabling session or cookie theft and full site takeover (high confidentiality and integrity impact). Affected deployments are Joomla sites running Articles Anywhere before 20.0.0, especially those that let untrusted or semi-trusted users author content that the plugin processes. No public proof of concept is known, the CVE is not on CISA's KEV list, and there is no evidence of in-the-wild exploitation to date.

Do: Upgrade Articles Anywhere to version 20.0.0 or later immediately. If upgrading is delayed, restrict the plugin so it does not process content from low-trust author groups, and do not rely on Joomla's built-in Author content filter, since the plugin syntax bypasses it. Audit existing articles for Articles Anywhere plugin tags carrying link options with event-handler attributes (e.g., onclick, onmouseover) and review user accounts and logs for signs of injected payloads or session abuse.

Conditional Content and Conditional Content Pro, Joomla extensions from Regular Labs, in versions before 8.0.0 accept inline PHP inside Condition Rules article syntax and pass it to their conditions evaluator without checking who authored the article. Because Joomla's normal Author text filter preserves the syntax, any authenticated user with article-authoring rights can embed PHP that runs as the web-server process as soon as the article is published and rendered. This effectively lets an author-level account escalate to full server-side code execution, reflected in a CVSS 4.0 score of 9.4 (critical) with a network attack vector and high privileges required. Sites running Conditional Content or Conditional Content Pro below 8.0.0 are affected. No public proof of concept is known, the issue is not on the CISA KEV list, and there is no evidence of exploitation in the wild.

Do: Upgrade Conditional Content and Conditional Content Pro to version 8.0.0 or later immediately. Until patched, restrict article-authoring rights to trusted users only, and review existing articles' Conditional Content rules for unexpected inline PHP. Audit author accounts and recently published articles for signs of injected code, since any author could have achieved code execution as the web-server user.

Tabs & Accordions, a Joomla extension from Regular Labs (regularlabs.com), contains a stored cross-site scripting (XSS) flaw in all versions before 3.1.0: the extension rewrites links matching an item alias into calls to its browser API and places that alias inside a quoted JavaScript argument within an HTML onclick attribute, without escaping either the JavaScript-string or the HTML-attribute context. An attacker with the privileged access needed to set the rtla-alias option (for example, a backend user permitted to edit the extension's items or relevant content) can supply a crafted data-rlta-alias value that alters the generated click handler and executes attacker-controlled JavaScript. Because the payload is stored and fires with no victim interaction, it can target higher-privileged users such as site administrators, enabling session theft and full site takeover (CVSS 4.0: 7.5, high). Affected deployments are Joomla sites running Tabs & Accordions earlier than 3.1.0, particularly those where semi-trusted users hold content- or extension-editing rights. The flaw is not in CISA's KEV catalog, and no public proof of concept or observed in-the-wild exploitation is known.

Do: Upgrade Tabs & Accordions to version 3.1.0 or later, which remediates the flaw. Audit existing articles and extension items for suspicious data-rlta-alias values or unexpected onclick handlers, and restrict which backend accounts are allowed to edit those items. If tampering is found, remove the injected content and reset administrator sessions and credentials.

Quick Index, a table-of-contents extension for Joomla from Regular Labs, fails to escape the configurable class option before inserting it into a generated HTML attribute in versions before 5.0.5. A user with high privileges, such as a trusted author or editor who can enter plugin syntax, can craft a class value that closes the intended attribute and injects a new attribute (for example an event handler), which then executes in the browsers of site visitors or other users viewing the page. Joomla's built-in content filtering cannot reliably block this because Quick Index constructs the executable HTML after the authored plugin syntax has already passed through the filter. The flaw is rated high severity (CVSS 4.0: 7.5) but requires an authenticated, privileged account, so it is most dangerous on sites where content authors are not fully trusted. No public proof of concept is known, the issue is not on the CISA KEV list, and no in-the-wild exploitation has been reported.

Do: Upgrade Quick Index to version 5.0.5 or later, which escapes class values before HTML generation. Until patched, restrict which Joomla user groups can create content or enter plugin syntax, and review existing Quick Index plugin tags for class values containing quotes, angle brackets, or 'on'-prefixed event names that could break out of the attribute. Also inspect rendered pages and server logs for suspicious injected attributes or anomalous session activity from privileged accounts.

Regular Labs' Modals extension for Joomla, in all versions before 17.0.0, treats a modal destination that uses an executable browser URL scheme (such as javascript:) as an ordinary modal URL. A user with high authoring privileges can store such a destination in content, and the value flows unchecked into both the generated link and the iframe-loading path. When a visitor views the content or opens the modal, the stored value can execute as JavaScript in that visitor's browser — bypassing Modals' separate, gated Pro JavaScript Events feature — enabling session/cookie theft or actions in the victim's context, up to administrator account takeover. Any Joomla site running Modals below 17.0.0 is affected, with practical risk concentrated on sites where semi-trusted users hold authoring or editing permissions. No public proof of concept exists, the flaw is not on the CISA KEV list, and no exploitation in the wild is known.

Do: Update Modals to version 17.0.0 or later on all Joomla sites as soon as possible. Audit existing articles and modal destinations for executable URL schemes (e.g., javascript:, data:, vbscript:) and remove or sanitize any found. Restrict authoring and editing privileges to trusted users, since exploitation requires high privileges to plant the stored payload.

Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager (Free, Pro) < 12.1.0, Conditional Content (Free, Pro) < 8.0.0, Content Templater (Pro) < 14.2.0, ReReplacer (Pro) < 16.2.0 for Joomla - The Conditions editor creates a default Condition Set name from the item to which the set is linked. The affected code accepts the database table and label-column names from the request. Although these names are quoted as SQL identifiers, they are not restricted to the tables and columns used by supported Regular Labs integrations. An attacker can therefore select a valid but unrelated database field. This is an authorization failure rather than SQL injection.

Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked directory confinement checks.

Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha (when no captcha plugin is enabled) and has no rate limiting. The attacker fully controls the recipient, subject and HTML body, and the mail is sent from the site's configured sender identity (mailfrom/fromname).

Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4 - Booking inquiries previously relied on client-submitted hidden fields for recipient routing, allowing potential email manipulation.

SP Property, a real-estate listing extension for Joomla by JoomShaper, fails to contextually escape attributes and text values when rendering multiple frontend view templates and administrator list tables, allowing unauthenticated attackers to inject script that later executes in victims' browsers. An attacker submits crafted content that is stored and then rendered directly into HTML without escaping; when a user, including a site administrator reviewing listings in the back end, loads an affected page, the injected JavaScript runs in that user's session. Successful exploitation can lead to cookie/session theft, unauthorized actions performed with the victim's privileges, and potentially broader site compromise if an administrator triggers the payload. Any Joomla installation running SP Property prior to version 4.1.4 is affected. As of now the flaw is not on CISA KEV, and no public proof-of-concept or confirmed in-the-wild exploitation is known.

Do: Upgrade SP Property to version 4.1.4 or later, which adds contextual escaping in the affected frontend views and administrator list tables. Until upgraded, restrict unauthenticated submission of listing-related data where feasible and review stored listing fields for injected HTML or JavaScript. Administrators should monitor for suspicious sessions or unexpected admin-account changes, since back-end list pages are among the unescaped render paths.

Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with arbitrary path strings or upload unverified file types.

SP Property, a real-estate listing component for Joomla from JoomShaper, versions before 4.1.4, processed POST requests on its visitor booking (properties.booking) and agent contact form (agents.sendmail) endpoints without verifying Joomla session anti-CSRF tokens (CWE-352). An attacker can host a page or link that induces a visitor's or logged-in user's browser to silently submit forged POST requests to these endpoints; because no token check is performed, the requests are accepted regardless of origin. The practical impact is rated high for integrity: an attacker can inject fraudulent booking submissions or trigger contact/email sends through the site's mail (e.g., spam or spoofed messages to agents), though no confidentiality impact is expected. Any Joomla site running SP Property prior to 4.1.4 is affected. There is currently no known exploitation, no public proof-of-concept, and the issue is not in CISA's KEV; a fix was released in SP Property 4.1.4.

Do: Upgrade SP Property to 4.1.4 or later, available from JoomShaper. Until updated, there is no built-in configuration mitigation, so review site logs for unexpected or forged POST submissions to the properties.booking and agents.sendmail endpoints and consider WAF rules or Joomla's CAPTCHA/token-hardening options as partial mitigations.

SP Property, a real-estate listing extension for Joomla from JoomShaper, contains an unauthenticated SQL injection (CWE-89) in the query builders for its property search and map-filtering features. Search and filter parameters such as zipcode, sorting, price_range_dropdown, and psize_range_dropdown are concatenated directly into WHERE and ORDER BY clauses without quoting or type casting, so crafted requests to the search or map endpoints execute attacker-controlled SQL. A remote attacker with no credentials can exploit this via boolean-based or time-based blind SQL injection to extract sensitive data from the Joomla site's database. Any Joomla site running SP Property versions prior to 4.1.4 that exposes the property search or map filtering to visitors is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known, and the flaw is not listed in CISA's KEV catalog.

Do: Upgrade SP Property to version 4.1.4 or later. Sites that cannot upgrade immediately should restrict or filter requests to the property search and map-filtering endpoints (the zipcode, sorting, price_range_dropdown, and psize_range_dropdown parameters, e.g. via WAF rules) and review web and database logs for slow or anomalous queries consistent with blind SQL injection. Verify the installed version in the Joomla extensions manager.

JooDatabase Lite, a Joomla extension by feenders.de, is vulnerable to unauthenticated SQL injection (CWE-89) in versions prior to 5.1.0. The extension passes the request's 'cid' parameter into SQL queries without validation, so an unauthenticated attacker can submit a crafted value for that parameter and have arbitrary SQL executed against the site's database. A successful attack can read, modify, or delete database content reachable by the component — potentially including sensitive Joomla data — with no privileges, authentication, or user interaction required. Any Joomla site running JooDatabase Lite below 5.1.0 and exposing the component's pages to anonymous visitors is affected. No public proof-of-concept or confirmed exploitation is known; EPSS assigns a 0.3% (20th percentile) probability of exploitation within the next 30 days.

Do: Upgrade JooDatabase Lite to version 5.1.0 or later. As interim mitigations, restrict the component's pages from unauthenticated access, apply strict integer validation on the 'cid' parameter via a WAF rule, or temporarily disable the component. Review web server logs for anomalous 'cid' values and audit the Joomla database for unexpected changes or injected records.

J2Store, an e-commerce extension for Joomla from j2commerce.com, contains a missing-authorization flaw (CWE-862) in its Apps controller delegation chain, where app-plugin controllers are instantiated without any ACL check anywhere in the code. Access control currently works only by accident: requests get a 403 as a side effect of fof.xml's wildcard-deny resolving under the singularized ACL key 'app' (which has no explicit allow rule), not because of a deliberate check, so an attacker who can reach the delegated controllers bypasses any intended authorization. Through that path, applocalizationdata::getInstallerTool() accepts a caller-influenced table name with no allow-list, using it to truncate #__j2store_* tables and to build a path to SQL files that it then executes, enabling path-traversal-based file read and execution. An attacker gains the ability to read files from arbitrary paths, execute their SQL contents, and destroy J2Store data via table truncation, with high impacts to confidentiality, integrity, and availability (CVSS 4.0: 9.5 critical, network vector, no privileges required). All Joomla sites running J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, or 4.1.0-4.1.6 are affected; there is no public PoC, no known in-the-wild exploitation (EPSS 0.2%, 15th percentile, not in CISA KEV).

Do: Update J2Store to releases later than 3.3.21, 4.0.21, and 4.1.6 respectively, published via j2commerce.com or the Joomla Extensions Directory (exact fixed version numbers were not provided in this advisory data, so confirm against the vendor's changelog). Until patched, do not rely on the current 403 behavior, since it is an incidental fof.xml side effect rather than a deliberate ACL check, and audit whether any #__j2store_* tables were truncated or unexpected SQL files executed. Monitor the Joomla CNA advisory for confirmed fixed versions and verify the update removes the missing-authorization issue in the Apps controller chain.

J2Store, a Joomla e-commerce extension, contains an insecure direct object reference (CWE-639) in its editAddress() function: the ownership check that redirects non-owners away only ran when the loaded address row had a non-empty user_id belonging to another user. Guest-checkout orders create address rows with an empty user_id, so the check never fired for them; any logged-in account that guesses a small, sequential address_id value had the guest customer's full name, street address, and phone number rendered prefilled into the edit form. An attacker with any low-privileged account on the site can therefore enumerate and read personal information of guest customers. Any Joomla site running J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, or 4.1.0-4.1.6 with guest checkout enabled is affected. Exploitation has not been observed: there is no public proof of concept, the CVE is not in CISA KEV, and EPSS puts 30-day exploitation probability at 0.2%.

Do: Upgrade J2Store to a release newer than the affected versions of the branch in use (later than 3.3.21, 4.0.21, or 4.1.6). As an interim mitigation, disable guest checkout or restrict which user roles can reach the address-edit endpoint. Check access logs for a single authenticated account rapidly requesting sequential address_id values, which would indicate enumeration of guest customer records.

J2Store, an e-commerce extension for Joomla from j2commerce.com, inherits the generic FOF framework 'save' task on its carts controller without overriding it, while its fof.xml grants the carts view's tasks a wildcard 'true' ACL and FOF only enforces CSRF tokens on back-end HTML requests rather than front-end format=raw requests. As a result, an unauthenticated remote attacker can call the save task against the front-end carts controller to insert new cart rows with an attacker-chosen user_id/session_id or overwrite an existing cart row by id; the extension had scoped remove() to the caller's own session but never applied the same restriction to save. Successful abuse allows tampering with other visitors' cart records — injecting or overwriting cart contents ahead of checkout — which drives the high (8.8) CVSS 4.0 score with high integrity impact and no privileges or user interaction required. Any Joomla site running J2Store 1.0.0–3.3.21, 4.0.0–4.0.21, or 4.1.0–4.1.6 is affected. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at just 0.2%, so no exploitation is currently known.

Do: Upgrade J2Store to a patched release later than the affected ranges in each branch — later than 3.3.21 on the 3.x line, 4.0.21 on the 4.0.x line, and 4.1.6 on the 4.1.x line. Because the flaw allows overwriting rows by id, administrators should inspect the J2Store cart records in the database for unexpected rows or rows with surprising user_id/session_id values. As an interim mitigation, consider blocking front-end requests to the carts controller's save task (especially with format=raw) at the web application firewall or reverse proxy.

Joomla Extension - j2commerce.com - Reflected XSS via `filter_tag`, `pricefrom` and `priceto` in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domain. No authentication required.

J2Store, a shopping-cart extension for Joomla, mishandles PayPal IPN callbacks: its `_validateIPN()` check treats any response other than a literal `INVALID` (including `UNVERIFIED`) as success, disables TLS peer verification (`CURLOPT_SSL_VERIFYPEER` off) on the verification call, and stores the verdict in a field that nothing downstream ever reads, so order processing proceeds regardless of the outcome. An unauthenticated attacker can send a forged callback POST using the sequential, enumerable order ID taken from the `custom` field and omitting `mc_gross` (which skips the paid-amount comparison entirely, since `floatval(null) == 0`), thereby marking any pending order as CONFIRMED with no payment or forcing another customer's pending order to FAILED; the `paypalv2.php` endpoint performs no amount check under any circumstances. The attacker gains fraudulent order confirmations that can lead merchants to ship goods for never-paid orders and can enumerate and tamper with other pending orders, with no confidentiality or availability impact (CVSS 4.0 8.7, integrity-only). Any Joomla site running J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, or 4.1.0-4.1.6 is affected, with sites actively processing PayPal payments through the extension directly exploitable. No public proof-of-concept is known, the flaw is not in CISA's KEV, and EPSS is 0.3% (17th percentile), so no confirmed exploitation is currently known.

Do: Upgrade J2Store to a release beyond the listed ranges (later than 4.1.6); until patched, disable the PayPal/IPN payment method in J2Store or manually reconcile every new CONFIRMED order against actual PayPal transactions before fulfillment. Audit recent orders for pending-to-CONFIRMED transitions lacking matching PayPal payments and for unexpected FAILED flips, since the sequential order IDs allow bulk forged callbacks.

Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate < 2.2.10 - Return redirect parameters accepted arbitrary Base64 strings without verifying whether the resolved target was an internal site URL via Uri::isInternal.

Helix Ultimate, JoomShaper's Joomla template framework, previously validated image uploads using only the file extension and basic size checks, so non-image files renamed with raster image extensions (content spoofing) could be uploaded past validation (CWE-434). The flaw requires an attacker to already hold high privileges on the Joomla site, such as administrator-level access, making it primarily a post-compromise escalation path rather than an initial-entry vector. Once accepted, a disguised file is stored and served as an image, and the 8.9 CVSS 4.0 score reflects potentially high impact on the site and connected systems where such files may be executed or consumed, though exploitation success can depend on site-specific conditions. All Joomla sites running Helix Ultimate versions below 2.2.10 are affected; version 2.2.10 adds strict MIME verification and GD-based raster decoding (imagecreatefromstring) that reject invalid or malformed images fail-closed. No public proof-of-concept is known, the flaw is not on CISA's KEV list, and EPSS currently estimates only a 0.3% chance of exploitation within 30 days.

Do: Update Helix Ultimate to version 2.2.10 or later. Audit media and upload directories for files bearing image extensions that are not actually valid images (e.g., by running MIME/file-type checks), and review administrator account security, since exploitation requires high privileges.

Helix Ultimate, JoomShaper's widely used Joomla template framework, prior to version 2.2.10 stores MegaMenu column and item configuration values without full sanitization and renders that stored layout JSON without complete contextual escaping, enabling stored cross-site scripting (CWE-79). An attacker with administrator-level privileges (CVSS 4.0 PR:High) can save malicious HTML or JavaScript into MegaMenu container or embed configuration fields, and the payload then executes whenever those stored values are rendered, with no additional user interaction required. Successful injection yields arbitrary JavaScript execution in the site's context, with high confidentiality and integrity impact per the 8.6 High CVSS 4.0 score, which can be used to hijack admin sessions, alter content, or persist a foothold in the backend. Any Joomla site running Helix Ultimate versions before 2.2.10 is affected, particularly sites with multiple or third-party administrators. No public proof-of-concept or known exploitation has been reported; EPSS is 0.3% (19th percentile) and the issue is not in CISA KEV.

Do: Upgrade Helix Ultimate to version 2.2.10 or later, which adds InputFilter sanitization with tag allowlists and htmlspecialchars contextual escaping. Until patched, review MegaMenu layout, container, and embed configuration values for unexpected HTML or scripts and remove any injected markup. Because exploitation requires administrator-level access, audit administrator accounts and rotate credentials if admin compromise is suspected.

Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions (core.edit on com_menus.item.{id} or core.admin). An authenticated user could submit modified layout parameters for arbitrary menu items without proper authorization.

Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10 - `Blog::remove_image()` checked whether the user was authorized to edit the article ID passed in the request, but did not verify whether the specified image path (src) belonged to that article. On Joomla 3 builds where physical file deletion was triggered, an author could supply their own article ID alongside an arbitrary file path under the `/images/` directory to delete arbitrary files.

Several free extensions for Joomla from miniOrange contain a missing authentication check (CWE-284) that allows an unauthenticated remote attacker to trigger deinstallation of arbitrary installed extensions. The flaw is triggered by sending crafted requests to the affected endpoint without any login or privileges. An attacker gains the ability to delete any extension on the site, which can break site functionality and login/SSO flows (high integrity and availability impact per the CVSS 4.0 vector), though the flaw does not by itself permit code execution or data theft. Only the free versions of the miniOrange Joomla plugins are affected; paid versions are not. Exploitation status is calm: no public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

Do: Joomla administrators running free miniOrange extensions should inventory which of these plugins are installed and check miniOrange's Joomla extension pages or advisories for patched releases, then upgrade promptly once fixed versions are published (no fixed version numbers are available in the source data). Because the bug allows unauthenticated deletion of arbitrary extensions, verify after updating that expected extensions (especially login/SSO components) are still installed. Until patched, consider limiting unauthenticated access to the Joomla administrative endpoints used by these plugins as an interim mitigation.

Joomla Extension - mrvinoth.com - Reflected XSS in All Video Share 1.0.0-4.5.0 - Various user supplied inputs lacked escaping, leading to reflected XSS vectors

Sexy Polling Reloaded, a polling component for Joomla by developer Jefferson49, contains an unauthenticated blind SQL injection flaw (CWE-89) in versions prior to 5.6.1. An attacker can trigger it by sending crafted input to the extension's publicly accessible polling functionality without any credentials; the flaw is blind, so results are inferred indirectly rather than returned directly in responses. Successful exploitation yields high-impact read access to the site's database per the CVSS 4.0 score, potentially exposing sensitive data such as user records or credentials depending on database contents. Any Joomla site running a version of the extension below 5.6.1 is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

Do: Update Sexy Polling Reloaded to version 5.6.1 or later. If upgrading is not immediately possible, restrict unauthenticated access to the component where feasible (for example via WAF or web-server rules) and review web server and database logs for unusual query patterns or slow responses, which are typical signs of blind SQL injection probing.

DPCalendar, a calendar extension for Joomla by Digital Peak, stores calendar location titles and later renders them inside an HTML data attribute without escaping, allowing injected markup to break out of the attribute. An authenticated user who holds the DPCalendar create permission can save a maliciously crafted location title, and the payload executes as JavaScript in the browsers of any user who views a page that displays that location. Successful exploitation lets the attacker run script in another user's Joomla session, enabling actions within that user's privileges such as content manipulation or session token theft, while the CVSS 4.0 score of 7.5 (high) reflects the privileged access requirement and high confidentiality/integrity impact. Affected deployments are Joomla sites running DPCalendar 7.0.0 through 8.19.5 or 9.0.0 through 10.12.0. No public proof-of-concept exists, the flaw is not in the CISA KEV catalog, and EPSS puts 30-day exploitation probability at only 0.3%, so no exploitation is currently known.

Do: Update DPCalendar to a release newer than 10.12.0 (i.e., the fixed version published in the Digital Peak/Joomla advisory). As interim mitigation, limit DPCalendar create permission to trusted users only, since exploiting the flaw requires that privilege, and audit existing calendar location titles for embedded HTML, quotes, or script payloads.

Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2 - Saving an article can trigger a blind SQL injection with content plugin, needs update permission for articles.

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution.

Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.1 - A non-manager can therefore read attendee names, usernames, registration dates and statuses for events they do not manage, including lists belonging to unpublished events.

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton() echoes it unescaped, leading to an reflected XSS vector.

Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.1 - A registered user with edit-own rights (the eventowner=1 setting or core.edit.own) can POST another user's record id together with their own id as created_by and take over that record.

Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager < 5.0.1 - Any visitor holding their own session token can republish and overwrite an article associated with an event.