Responsible Disclosure
A complete list of vulnerabilities we found and responsibly reported
106 CVEs where Phil E. Taylor / mySites.guru found and reported: 15 in Joomla core and 91 across 25 third-party extensions, from 2018 to 2026. This is what we found and reported to the developer, not what we wrote about, so it leaves out flaws others reported that we only covered. Some name us on the CVE record; others were fixed and numbered with no credit at all. Two are shared credits, where someone else found the other half of the same flaw, and those rows say so.
Every one of these came out of our own investigation work: auditing an extension after a customer's site was hacked, or reading code we could see running across the sites we manage. When we find something, it goes to the developer privately first and we publish only once a fixed release is available, so site owners have somewhere to update to on the day they read about it.
The other half of that exchange belongs to the developer receiving the report. Joomla's official developer documentation now sets out twenty rules for handling a security report, written by David Jardin of the Joomla Security Strike Team, the team that operates Joomla's CVE Numbering Authority. It is his work and the Joomla Project's, not ours; we republished it in full under the JEDL and added what it looks like from the reporting side. A published security contact is the single rule that changes the most, because it works before anything has gone wrong.
We currently have 5 more vulnerabilities inside their responsible disclosure embargo, with details to follow once each vendor has shipped a fix. Subscribe to the newsletter to get alerts if you are not already a mySites.guru subscriber.
| CVE | Product | Severity | What it was |
|---|---|---|---|
| CVE-2026-78071 | DPCalendarDigital Peak / Allon Moritz | 7.5 High | Authenticated stored XSS via an unescaped location title in a data-title attribute (com_dpcalendar); the 10.12.0 fix escaped nine of ten sinks and we found the tenth (shared credit with Toan Le, never cite as a solo find) Read the write-up |
| CVE-2026-78374 | T4 Page BuilderJoomlArt | 6.9 Medium | Unauthenticated open mail relay in the front-end contact endpoint (com_t4pagebuilder); the contact action was exempt from the component's ACL checks and sent mail to an attacker-supplied recipient using the site's own sender identity, with no form token and no rate limiting; published by the Joomla CNA crediting no reporter Read the write-up |
| CVE-2026-78082 | SP Property FinderJoomShaper | 9.3 Critical | Unauthenticated blind SQL injection in the public property search and map views (com_spproperty); several filter values were concatenated into the query with no quoting, letting an anonymous visitor read the entire Joomla database, password hashes and the site secret included. Read-only; the Joomla CNA rates it 9.3 Critical, we assess the read-only injection at 8.7 High Read the write-up |
| CVE-2026-78075 | Helix Ultimatejoomshaper.com | 5.1 Medium | Authenticated broken object-level authorization in blog image deletion (helixultimate); Blog::remove_image() checks whether the caller may edit the article id in the request but never confirms the supplied src path belongs to that article, so an author who owns one article deletes arbitrary files under /images/ on Joomla 3 builds |
| CVE-2026-60034 | JMediaThemeXpert | 9.4 Critical | Stored XSS via unsanitised SVG served without nosniff - from Phil's Quix / JMedia disclosure; the CNA record names no reporter Read the write-up |
| CVE-2026-60033 | JMediaThemeXpert | 5.1 Medium | SSRF via remote-URL download to internal / reserved addresses - from Phil's Quix / JMedia disclosure; the CNA record names no reporter Read the write-up |
| CVE-2026-60032 | JMediaThemeXpert | 9.4 Critical | Authenticated arbitrary file upload to RCE via polyglot/executable - from Phil's Quix / JMedia disclosure; the CNA record names no reporter Read the write-up |
| CVE-2026-60031 | Quix Page Builder ProThemeXpert | 6.9 Medium | Information disclosure: raw exceptions reflected in AJAX responses (com_quix) - from Phil's Quix / JMedia disclosure; the CNA record names no reporter Read the write-up |
| CVE-2026-60030 | Quix Page Builder ProThemeXpert | 8.7 High | Improper access control: media upload regardless of permissions (com_quix) - from Phil's Quix / JMedia disclosure; the CNA record names no reporter Read the write-up |
| CVE-2026-60029 | Quix Page Builder ProThemeXpert | 5.1 Medium | Authenticated stored XSS via id/class fields, rendered publicly (com_quix) - from Phil's Quix / JMedia disclosure; the CNA record names no reporter Read the write-up |
| CVE-2026-60028 | Quix Page Builder ProThemeXpert | 8.6 High | Authenticated stored XSS via element content and icon field (com_quix) - from Phil's Quix / JMedia disclosure; the CNA record names no reporter Read the write-up |
| CVE-2026-60027 | Quix Page Builder ProThemeXpert | 8.7 High | Unauthenticated path traversal / arbitrary file read via Form elements (com_quix) - from Phil's Quix / JMedia disclosure; the CNA record names no reporter Read the write-up |
| CVE-2026-60026 | Quix Page Builder ProThemeXpert | 8.9 High | Authenticated PHP code execution via Raw HTML element content (com_quix) - from Phil's Quix / JMedia disclosure; the CNA record names no reporter Read the write-up |
| CVE-2026-78303 | SP Property FinderJoomShaper | 6.9 Medium | Unauthenticated mail relay on the property booking and contact forms (com_spproperty); the recipient came from the request, so the site could be made to send mail to any address with a spoofed sender. Our find; the CNA record names no reporter Read the write-up |
| CVE-2026-78069 | J2Store / J2Commercej2commerce.com | 9.4 Critical | Authenticated (any backend account) missing authorization on the Apps controller delegation chain (com_j2store); appTask instantiates app-plugin controllers with no com_j2store ACL check anywhere, and the backend node of fof.xml declares no view ACL at all, so the framework defaults an unmatched task to allow. Any account able to log into the Joomla administrator, holding no J2Store permission whatsoever, reaches table truncation and traversal-based SQL file execution Read the write-up |
| CVE-2026-78065 | J2Store / J2Commercej2commerce.com | 7.1 High | Authenticated guest-checkout address disclosure in J2Store (com_j2store); editAddress() redirects a non-owner only when the loaded row has a non-empty user_id, and guest-checkout rows have none, so any logged-in account enumerating address_id is shown a guest customer's full name, street address and phone prefilled into the edit form Read the write-up |
| CVE-2026-78064 | J2Store / J2Commercej2commerce.com | 8.8 High | Unauthenticated cart-record tampering in J2Store (com_j2store); fof.xml grants the carts view a wildcard true ACL and the framework enforces CSRF only on backend HTML requests, so an anonymous format=raw POST inserts cart rows with an attacker-chosen user_id or session_id, or overwrites an existing row by id Read the write-up |
| CVE-2026-78000 | J2Store / J2Commercej2commerce.com | 5.3 Medium | Unauthenticated reflected XSS in J2Store (com_j2store) via filter_tag, pricefrom and priceto; J2Html::input()'s hidden branch echoes the value unescaped into the attribute across all six shipped product-tags template families, so a crafted link fires script on page open Read the write-up |
| CVE-2026-77999 | J2Store / J2Commercej2commerce.com | 8.7 High | Unauthenticated PayPal payment-callback forgery in J2Store (com_j2store); _validateIPN() accepts UNVERIFIED and anything not literally INVALID, runs with SSL peer verification disabled, and stores its verdict in a field nothing downstream reads, while omitting mc_gross skips the paid-amount check entirely, so an anonymous request confirms an unpaid order or fails a legitimate one Read the write-up |
| CVE-2026-77998 | miniOrange SAML SSOminiorange.com | 10.0 Critical | Unauth authentication bypass via SAMLResponse (com_miniorange_saml); validateSignature() tests the tri-state return of openssl_verify() as a boolean, so the -1 error value reads as a valid signature a Read the write-up |
| CVE-2026-77992 | Fabrikfabrikar.com | 9.5 Critical | Heredoc escaping breakout in calc element Read the write-up |
| CVE-2026-77991 | JEM - Joomla Event Managerjoomlaeventmanager.net | 9.4 Critical | Privileged RCE, administrator source model writes PHP Read the write-up |
| CVE-2026-77990 | JEM - Joomla Event Managerjoomlaeventmanager.net | 5.3 Medium | Attendee lists readable by any logged-in user Read the write-up |
| CVE-2026-77989 | JEM - Joomla Event Managerjoomlaeventmanager.net | 5.3 Medium | Reflected XSS via the PDF export link Read the write-up |
| CVE-2026-77035 | JEM - Joomla Event Managerjoomlaeventmanager.net | 5.1 Medium | Cross-user event and venue takeover via forged form fields Read the write-up |
| CVE-2026-77034 | JEM - Joomla Event Managerjoomlaeventmanager.net | 6.9 Medium | Unauth article overwrite and force-publish Read the write-up |
| CVE-2026-77029 | ZOOYOOtheme | 4.6 Medium | Missing CSRF tokens on front-end state changes, including submission deletion (com_zoo); scored PR:H Read the write-up |
| CVE-2026-77028 | ZOOYOOtheme | 5.3 Medium | Unauth reflected XSS and open redirect via the submission redirect parameter (com_zoo); the changelog mentions only the redirect half Read the write-up |
| CVE-2026-76612 | ZOOYOOtheme | 8.6 High | Unauth stored XSS (com_zoo); input in comments and in user-supplied field elements is not escaped on output, so a guest stores script that later runs in the browser of any viewer, administrators inclu Read the write-up |
| CVE-2026-76611 | ZOOYOOtheme | 6.9 Medium | Unauth arbitrary directory listing via the Gallery element in front-end submission (com_zoo); YOOtheme describe the same fix as a path traversal Read the write-up |
| CVE-2026-76610 | ZOOYOOtheme | 6.9 Medium | Unauth tag modification (com_zoo); the CNA records the comment controller endpoint as lacking ACL checks, so tags could be renamed or deleted with no login. The shipped 4.1.64 package also left the ad Read the write-up |
| CVE-2026-76609 | Fabrikfabrikar.com | 6.9 Medium | Unauth modification of any comment Read the write-up |
| CVE-2026-76608 | Fabrikfabrikar.com | 6.9 Medium | Unauth disclosure of any commenter's email Read the write-up |
| CVE-2026-76607 | Fabrikfabrikar.com | 10.0 Critical | Missing access check in download plugin FK branch Read the write-up |
| CVE-2026-76606 | Fabrikfabrikar.com | 10.0 Critical | Path traversal in image element Read the write-up |
| CVE-2026-76605 | Fabrikfabrikar.com | 10.0 Critical | Unauth RCE via image element with eval flag Read the write-up |
| CVE-2026-76604 | Fabrikfabrikar.com | 10.0 Critical | Unauth RCE via form_php _runPHP Read the write-up |
| CVE-2026-76603 | Fabrikfabrikar.com | 6.9 Medium | Unauth row disclosure via form.inlineedit Read the write-up |
| CVE-2026-76602 | Fabrikfabrikar.com | 9.3 Critical | Unauth SQLi in ORDER BY (CONCAT( allowlist bypass) Read the write-up |
| CVE-2026-76601 | Fabrikfabrikar.com | 6.9 Medium | Unauth row reordering (Order plugin) Read the write-up |
| CVE-2026-76600 | Fabrikfabrikar.com | 6.9 Medium | Unauth deletion of any comment Read the write-up |
| CVE-2026-76599 | Fabrikfabrikar.com | 8.7 High | Unauth database table list and table-prefix disclosure Read the write-up |
| CVE-2026-76598 | Fabrikfabrikar.com | 8.7 High | Unauth arbitrary directory listing (onAjax_getFolders) Read the write-up |
| CVE-2026-76597 | Fabrikfabrikar.com | 8.7 High | Unauth arbitrary file upload to web root (list email plugin) Read the write-up |
| CVE-2026-76596 | Fabrikfabrikar.com | 8.7 High | Unauth table truncation via list.doempty Read the write-up |
| CVE-2026-76571 | Fabrikfabrikar.com | 9.3 Critical | Unauth SQLi in list filter condition parameter Read the write-up |
| CVE-2026-75114 | ZOOYOOtheme | 5.1 Medium | Unauth open redirect in CommentController::twitterAuthenticate() (com_zoo); the referer parameter reaches setRedirect() with no scheme or host validation Read the write-up |
| CVE-2026-74804 | ZOOYOOtheme | 9.3 Critical | Unauth SQL injection in ItemController::element() (com_zoo); filter_type interpolated as a.type = "..." and type_filter as a.type IN ("..."), no quoting - bypasses state/access filters, full DB read b Read the write-up |
| CVE-2026-74803 | ZOOYOOtheme | 10.0 Critical | Unauth arbitrary file upload → RCE (com_zoo); the front-end submission Image element validates the client-supplied Content-Type only, never the file contents, and File::makeSafe preserves .php - a gue Read the write-up |
| CVE-2026-74254 | Page Builder CKjoomlack.fr | Unrated | Authenticated SQL injection in the styles handling (com_pagebuilderck); style ids concatenated into an IN (...) with no cast, payload fires when the page is rendered. The 3.6.4 release meant to fix it Read the write-up |
| CVE-2026-67286 | SP Page BuilderJoomShaper | 6.3 Medium | Unauth arbitrary directory creation and file write with a predefined name (com_sppagebuilder) Read the write-up |
| CVE-2026-67285 | SP Page BuilderJoomShaper | 9.2 Critical | Unauth arbitrary local PHP file inclusion via loadMoreCollectionData (com_sppagebuilder); pre-auth RCE, proved live Read the write-up |
| CVE-2026-67284 | Cotton CloudJonatas C. Ferreira / tabaoca.org | 5.3 Medium | Missing authorisation / cross-user IDOR (com_cotton); the authorisation half of the same disclosure, so a logged-in user reaches another user's stored files regardless of owner Read the write-up |
| CVE-2026-67283 | Cotton CloudJonatas C. Ferreira / tabaoca.org | 6.9 Medium | Unauth access to the whole file store (com_cotton): the login check sits in the view layer, so every task= endpoint is gated by a CSRF token alone, which Joomla issues to guests Read the write-up |
| CVE-2026-66915 | Fabrikfabrikar.com | 10.0 Critical | Unauth RCE in calc element (shared credit with Moe Khalilov and Kai Huang, never cite as a solo find) Read the write-up |
| CVE-2026-66490 | GridboxBalbooa | Unrated | Stored XSS via a comment avatar (com_gridbox) Read the write-up |
| CVE-2026-66489 | GridboxBalbooa | Unrated | Unauth file system disclosure, several vectors (com_gridbox) Read the write-up |
| CVE-2026-66488 | GridboxBalbooa | Unrated | Payment bypass (com_gridbox) Read the write-up |
| CVE-2026-65947 | GridboxBalbooa | Unrated | CSRF across the admin interface, several vectors (com_gridbox) Read the write-up |
| CVE-2026-65890 | GridboxBalbooa | 9.2 Critical | Unauth SQL injection, multiple vectors (com_gridbox) Read the write-up |
| CVE-2026-65889 | GridboxBalbooa | 9.2 Critical | Unauth recursive directory deletion (com_gridbox); generateNewApp deletes directory trees Read the write-up |
| CVE-2026-65888 | GridboxBalbooa | 10.0 Critical | Unauth account takeover (com_gridbox); socialLogin logs the caller in as any named user on the site Read the write-up |
| CVE-2026-65887 | GridboxBalbooa | 10.0 Critical | Unauth arbitrary password reset (com_gridbox); resetPassword resets any user's password, Super Users excepted, then logs in as them Read the write-up |
| CVE-2026-65886 | GridboxBalbooa | 9.2 Critical | Unauth arbitrary file read via the photo viewer (com_gridbox) Read the write-up |
| CVE-2026-65885 | GridboxBalbooa | 9.4 Critical | Authenticated arbitrary file upload (com_gridbox); chains with CVE-2026-65884 into unauthenticated RCE, which is how the CNA describes it Read the write-up |
| CVE-2026-65884 | GridboxBalbooa | 10.0 Critical | Unauth privilege escalation (com_gridbox); the registration method accepts a caller-supplied usergroup ID, so an anonymous visitor registers an account holding administrative permissions Read the write-up |
| CVE-2026-65879 | SP Page BuilderJoomShaper | Unrated | Unauth open mail relay from a product-wide hard-coded secret (com_sppagebuilder, CWE-798) Read the write-up |
| CVE-2026-65878 | SP Page BuilderJoomShaper | 8.3 High | Authenticated arbitrary file delete via traversal (com_sppagebuilder) Read the write-up |
| CVE-2026-65877 | SP Page BuilderJoomShaper | 8.2 High | Authenticated SQL injection in the media manager (com_sppagebuilder) Read the write-up |
| CVE-2026-65766 | SP Page BuilderJoomShaper | 9.2 Critical | Unauth SQL injection in the dynamic_content ORDER BY (com_sppagebuilder); anonymous full DB read Read the write-up |
| CVE-2026-65761 | EasyStoreJoomShaper | 9.3 Critical | Unauth SQL injection via filter_sortby ORDER BY (com_easystore); anonymous full DB read incl. password hashes Read the write-up |
| CVE-2026-65760 | EasyStoreJoomShaper | 9.2 Critical | Cross-customer order/invoice IDOR (com_easystore); logged-in customer reads any order's PII + printable invoice Read the write-up |
| CVE-2026-65759 | EasyStoreJoomShaper | 8.7 High | Unauth order/payment forgery via checkout.orderRepay (com_easystore); anonymous write of payment_status + arbitrary order fields Read the write-up |
| CVE-2026-63048 | Page Builder CKjoomlack.fr | 9.4 Critical | Authenticated arbitrary file upload → RCE (com_pagebuilderck); the 3.6.0 fix for CVE-2026-56290 gated the endpoint but left the extension allow-list commented out, so any core.edit account (default Ed Read the write-up |
| CVE-2026-63047 | Events BookingJoomDonation / Ossolution | Unrated | Unauth invoice IDOR (com_eventbooking); anonymous download of any registrant's PDF invoice - full name, organisation, postal address, email, amount paid - by walking the registration id Read the write-up |
| CVE-2026-61425 | GridboxBalbooa | 10.0 Critical | Unauth authentication bypass via an attacker-controlled cookie (com_gridbox) → Super User → RCE via template edit Read the write-up |
| CVE-2026-61424 | DJ-ClassifiedsDJ-Extensions.com | High | Unauth arbitrary file upload via the imageupload task (com_djclassifieds); web shell hidden in a valid image, RCE on misconfigured hosts Read the write-up |
| CVE-2026-60025 | Events BookingJoomDonation / Ossolution | Unrated | Missing CSRF token on the front-end file-upload endpoint (com_eventbooking) Read the write-up |
| CVE-2026-60024 | Events BookingJoomDonation / Ossolution | Unrated | Unauth media upload allowed by default (com_eventbooking); no login Read the write-up |
| CVE-2026-58149 | Events BookingJoomDonation / Ossolution | 6.9 Medium | Unauth user enumeration (IDOR) via get_profile_data (com_eventbooking); anonymous read of name + email for every user Read the write-up |
| CVE-2026-58078 | Quix Page Builder ProThemeXpert | 8.7 High | Unauth error-based SQL injection via a front-end element AJAX handler (com_quix); anonymous read of any DB table incl. password hashes Read the write-up |
| CVE-2026-57832 | EDocmanJoomDonation / Ossolution | 8.7 High | Unauth SQL injection via a public front-end endpoint (com_edocman); anonymous read of any DB table incl. password hashes Read the write-up |
| CVE-2026-57831 | DPCalendarDigital Peak / Allon Moritz | 8.7 High | Unauth blind SQL injection via filter_created_by on the public events feed (com_dpcalendar); anonymous read of any DB table Read the write-up |
| CVE-2026-57828 | Phoca Downloadphoca.cz / Jan Pavelka | 9.0 Critical | Authenticated member-upload allow-list bypass (com_phocadownload) → RCE Read the write-up |
| CVE-2026-57827 | RSFiles!rsjoomla.com | 10.0 Critical | Unauth file upload via front-end rsfiles.upload task (com_rsfiles) → RCE Read the write-up |
| CVE-2026-56292 | AcyMailingAcyba / acymailing.com | 8.7 High | Unauth SQL injection via public front-end endpoint (com_acym); anonymous read of any DB table incl. password hashes Read the write-up |
| CVE-2026-56291 | Balbooa Formsbalbooa.com | 10.0 Critical | Unauth file upload via form.uploadAttachmentFile (com_baforms) → RCE Read the write-up |
| CVE-2026-56290 | Page Builder CKjoomlack.fr | 10.0 Critical | Unauth file upload via browse.ajaxAddPicture (com_pagebuilderck) → RCE Read the write-up |
| CVE-2026-49049 | Helix3 frameworkJoomShaper | Unrated | Unauth com_ajax handler: arbitrary file delete / JSON write / template-param update (helix3) Read the write-up |
| CVE-2026-48939 | iCagendaicagenda.com | 10.0 Critical | Unauth file upload in event file-attachment feature → RCE Read the write-up |
| CVE-2026-48908 | SP Page BuilderJoomShaper | 10.0 Critical | Unauth file upload via asset.uploadCustomIcon → RCE Read the write-up |
| CVE-2026-23898 | Joomla! CMS coreJoomla! Project | 8.6 High | Arbitrary file deletion in com_joomlaupdate Read the write-up |
| CVE-2023-23755 | Joomla! CMS coreJoomla! Project | Medium | Bruteforce prevention within the MFA screen |
| CVE-2022-23799 | Joomla! CMS coreJoomla! Project | Low | Variable tampering on JInput $_REQUEST data |
| CVE-2022-23795 | Joomla! CMS coreJoomla! Project | Low | User row not bound to an authentication mechanism |
| CVE-2021-26034 | Joomla! CMS coreJoomla! Project | Low | CSRF in data download endpoints |
| CVE-2021-26033 | Joomla! CMS coreJoomla! Project | Low | CSRF in AJAX reordering endpoint |
| CVE-2021-23123 | Joomla! CMS coreJoomla! Project | Low | com_modules exposes module names |
| CVE-2020-35614 | Joomla! CMS coreJoomla! Project | Low | User enumeration in backend login |
| CVE-2020-35612 | Joomla! CMS coreJoomla! Project | Low | Path traversal in mod_random_image |
| CVE-2020-35610 | Joomla! CMS coreJoomla! Project | Low | com_finder ignores access levels on autosuggest |
| CVE-2020-15698 | Joomla! CMS coreJoomla! Project | Low | System Information screen could expose redis/proxy credentials |
| CVE-2020-15697 | Joomla! CMS coreJoomla! Project | Low | Variable tampering via user table class |
| CVE-2020-15696 | Joomla! CMS coreJoomla! Project | Low | Escape mod_random_image link |
| CVE-2019-18674 | Joomla! CMS coreJoomla! Project | Low | Path disclosure in phputf8 mapping files |
| CVE-2018-11327 | Joomla! CMS coreJoomla! Project | Medium | Information disclosure about unpublished tags |
A CVE links to our record page where we track a rule for it, and to cve.org otherwise. Joomla core issues are not tracked as extension rules, so those link out. Every one of these is also in the Joomla CVE index if it has a record.
Unauthenticated SQL Injection in SP Property Finder found by mySites.guru
mySites.guru found an unauthenticated blind SQL injection in JoomShaper's SP Property Finder. Any visitor could read the database. Fixed in 4.1.4.
T4 Page Builder 2.3.0 Fixes an Unauthenticated Mail Relay
JoomlArt's T4 Page Builder 2.3.0 closes an unauthenticated open mail relay we reported in August. A week on, five in six installs we see are still older.
J2Store 3.3.22, 4.0.22 and 4.1.7 fix five flaws we reported
J2Store 3.3.22, 4.0.22 and 4.1.7 fix five flaws mySites.guru reported, including anonymous PayPal order confirmation and a 9.5 backend escalation.
Five Security Issues in JEM (Joomla Event Manager), and No Stable Fix Yet
mySites.guru found and reported multiple security issues in JEM (Joomla Event Manager), including an unauthenticated article overwrite. No stable fix yet.
Unauthenticated Remote Code Execution in SP Page Builder found by mySites.guru
mySites.guru found a pre-authentication remote code execution flaw in SP Page Builder for Joomla, in the same release that fixed our earlier reports.
Cotton Cloud Patched the Login, Then the Data
Two access control flaws in Cotton Cloud for Joomla. The first fix closed the door, not the room. CVE-2026-67283 and CVE-2026-67284 are fixed in 2.0.3.
Twenty Rules for Joomla Extension Developers Handling a Security Report
A new Joomla Manual page sets out 20 rules for how extension developers should handle a security report. Republished here in full under the JEDL.
Another 23 Critical Security Vulnerabilities in Gridbox for Joomla
Balbooa asked mySites.guru to audit Gridbox for Joomla. We found 23 vulnerabilities, including a pre-auth RCE, some exploited already. Fixed in 2.20.2.
Pre-Authentication SQL Injection and Mail Relay in SP Page Builder found by mySites.guru
mySites.guru found four vulnerabilities in SP Page Builder for Joomla: a SQL injection and a mail relay, fixed in 6.7.1. A fifth survived to 6.8.0.
Exposed Customer Invoices, Order Forgery and SQL Injection in EasyStore for Joomla found by mySites.guru
Before EasyStore 2.0.2, any logged-in customer could read every other customer's invoice by editing one URL. mySites.guru found this and two more flaws.
Events Booking for Joomla exposes personal and financial data from invoices
An unauthenticated flaw in Events Booking for Joomla let anyone download any registrant's invoice, with their name, address, email and payment. Fixed in 5.8.2.
Gridbox for Joomla: One Cookie and You Are a Super User
A critical unauthenticated authentication bypass in Gridbox for Joomla let anyone become a Super User by setting a single cookie. Fixed in 2.20.1. Update now.
Events Booking for Joomla: Anyone Could Upload Files to Your Server
mySites.guru found two unauthenticated flaws in Events Booking for Joomla: file upload enabled by default, and a leak of every user's name and email.
We Are Not the Only Ones Auditing Joomla Extensions
Two Joomla extension flaws went public via the Joomla CNA: a SQL injection in JoomCCK and a stored XSS in ChronoForms. Neither was ours. Update now.
Unauthenticated SQL Injection in Quix Page Builder found by mySites.guru
mySites.guru found and reported CVE-2026-58078, an unauthenticated SQL injection in Quix Page Builder for Joomla. Fixed in 6.2.1; update to 6.2.2.
Unauthenticated SQL Injection in EDocman found by mySites.guru
mySites.guru found an unauthenticated SQL injection in EDocman for Joomla that let anyone read the whole database. Fixed in 3.9.0 - update now.
Nineteen and Counting: Joomla Extension Vulnerabilities We Found and Disclosed in a Month
In just over a month mySites.guru found and responsibly disclosed nineteen security issues in popular Joomla extensions, most of them critical.
Unauthenticated SQL Injection in DPCalendar found by mySites.guru
mySites.guru found and reported an unauthenticated SQL injection in the DPCalendar Joomla extension's public events feed. Fixed in 10.11.2 and 8.19.4.
Unauthenticated SQL Injection in AcyMailing found by mySites.guru
mySites.guru found and reported CVE-2026-56292, an unauthenticated SQL injection in AcyMailing for Joomla and WordPress. Update to 10.11.1 now.