mySites.guru Joomla CVE index

CVE-2026-102784 - Gridbox (High)

Thu, 08 Oct 2026 00:00:00 GMT

Balbooa released Gridbox 2.20.4.0 on 8 October 2026 with two security fixes: a Cross-Site Request Forgery (CSRF) vulnerability in the language installation process, and improved file path validation in the image preview so images can only be read from inside the configured media directory. The CSRF flaw is in an administrator-only action, so it needs a logged-in Super User to be tricked into opening a crafted link or page; because that action installs software, the consequence is serious even though it cannot be triggered by an anonymous visitor alone. We confirmed both changes by comparing the public 2.20.4.0 package with earlier releases; both affected areas are present from 2.20.2 onwards. Reported by Sergiy Tryzhychynskyi, coordinated by the Joomla Security Strike Team. Not a mySites.guru finding. No CVE had been assigned at the time of writing; the severity shown is our own assessment, not an official CVSS score. Update to 2.20.4.0. Earlier versions are covered by separate rules with more serious advisories, and should also go straight to 2.20.4.0.

CVE-2026-102783 - Gridbox (High)

Thu, 08 Oct 2026 00:00:00 GMT

CVE-2026-102782 - OrdaSoft Simple Membership (Critical)

Wed, 07 Oct 2026 00:00:00 GMT

OrdaSoft Simple Membership versions before 7.4.0 are vulnerable to unauthenticated SQL injection. site/simplemembership.php dispatches task=checkLoginPass with no authentication or access check, reads a login parameter through Joomla's generic input filter (which strips tags but leaves quotes and SQL syntax intact) and concatenates it straight into a database query. An anonymous visitor can read or alter database contents, including user accounts and password hashes. Update to 7.4.0 or later. OrdaSoft has published no advisory or changelog; the fixed version comes from the CVE record. Until a fixed version is installed, disable the component or block requests with task=checkLoginPass at the web server.

CVE-2026-102781 - OrdaSoft Touch Slider (Medium)

Wed, 07 Oct 2026 00:00:00 GMT

OrdaSoft Touch Slider (OS Touch Slider / OrdaSoft Joomla Slider) versions 1.0.0 to 5.4.5 route every data-management operation through modOsTouchSliderHelper::getAjax(), reached via Joomla core com_ajax, with no user check, no authorise() call and no CSRF token. An unauthenticated attacker can delete any slider image by its sequential ID with a plain GET request, and can upload a zip that replaces the slider tables (#__os_touch_slider and #__os_touch_slider_text) site-wide with attacker-supplied content. No login is required. Update to 5.4.6 or later. Until then, unpublish or uninstall the module.

CVE-2026-102780 - TF Content (Medium)

Mon, 05 Oct 2026 00:00:00 GMT

TF Content by Joomla Fry, versions 2.9.0 to 2.9.4, contains two unauthenticated missing-authorisation flaws, both fixed in 2.9.5. 1) CVE-2026-102779 (CWE-862, CVSS 4.0 6.9 Medium): the site task records.custom_action is exposed without authentication, ACL, CSRF, task-trigger, content-binding or cron-token checks, so an unauthenticated visitor can supply the numeric ID of any published TF Content task and force the component to run its configured executor immediately. 2) CVE-2026-102780 (CVSS 4.0 6.9 Medium): the public RecordController unconditionally authorises both creating and editing records, and the shared front-end save controller saves the raw jform array against a request-selected record ID without filtering it through the configured form. A guest can take a valid token from Joomla's public login form and modify any TF Content record, including mass-assigning its published state, access level and author (created_by). Update to TF Content 2.9.5 or later. Temporary mitigation: unpublish any TF Content automation tasks whose executors should not be triggered on demand, and disable the TF Content front-end record forms until you can update.

CVE-2026-102779 - TF Content (Medium)

Mon, 05 Oct 2026 00:00:00 GMT

CVE-2026-102428 - OS CCK (Critical)

Mon, 05 Oct 2026 00:00:00 GMT

OrdaSoft OS CCK versions before 8.3.16 (Light/free line) are affected by an unauthenticated SQL injection in the front-end listing views, where the record-sort parameters (order_field / order_direction) were passed into the query ORDER BY clause without being restricted to known-safe columns (CVE-2026-102428, CVSS 4.0 9.3 Critical as scored by the Joomla CNA, which gives the affected range as 1.0.0 to 8.3.15). OrdaSoft fixed this in 8.3.16 (released 29 September 2026) by validating the sort field against the real entity columns, alongside image-upload and file-handling hardening. This is the same class as four OrdaSoft extension flaws disclosed in the same September 2026 wave - Real Estate Manager (CVE-2026-100752), Vehicle Manager (CVE-2026-101108), Book Library (CVE-2026-101110) and OS Gallery (CVE-2026-88854) - all unauthenticated SQL injection via the same sort parameters on publicly reachable listing pages. Important: OrdaSoft's own Joomla update manifest still advertises 8.3.14, so affected sites are NOT offered 8.3.16 automatically and must update manually from ordasoft.com. The Pro-edition fixed version could not be independently confirmed. Update to 8.3.16 or later.

CVE-2026-102426 - SP Page Builder (Medium)

Mon, 05 Oct 2026 00:00:00 GMT

SP Page Builder Pro's Dynamic Content Filter addon takes the range-slider minimum and maximum from the dc_filter_ request parameter, escapes the value inside the data-value attribute, and then prints the same value unescaped as the label's text a few characters later. An unauthenticated attacker can send a crafted link to a page using the filter and run script in the browser of whoever opens it, as the site (CVE-2026-102426, CVSS 4.0 5.3 Medium as scored by the Joomla CNA). The CNA record gives the range as 3.0.0 to 5.6.1 with the 1.0.2 Joomla 3 patch applied; this rule starts at 5.5.0 because dynamic content first shipped in 5.5.0 and the 3.8.x branch has no Dynamic Content Filter addon at all, and it runs to the end of the 5.x line because 5.7.2 still prints the value unescaped. The 6.x branch escapes both values. Fix: on Joomla 4, 5 or 6, update to the current SP Page Builder 6.x release. On Joomla 3, SP Page Builder 5.6.1 can take JoomShaper's Joomla 3 Security Patch 1.0.3, which escapes both values but does not change the reported version, so a 5.6.1 site with 1.0.3 applied still shows here; the Unpatched JoomShaper Security Holes tool reports which patch release is actually installed. Until you can update, remove the Dynamic Content Filter addon from public pages.

CVE-2026-102778 - Event Gallery (Medium)

Sun, 04 Oct 2026 00:00:00 GMT

Event Gallery (Core and Extended) versions before 6.6.0 contain three security flaws, fixed by the vendor in 6.6.0 (4 October 2026). 1) CVE-2026-102776 (vendor advisory EGSA-2026-06, vendor severity 5.1 Medium): eight buttons in the backend lists did not check the Joomla form token (the default payment and shipping method, image type sets, order statuses and watermarks, In shop of an event, the main image of an event and the main-image-only flag, and the sorting of an event's images). A page on another website could trigger them while an administrator was logged in to the backend and change those settings and flags. Nothing could be deleted or read this way and orders were not affected. 2) CVE-2026-102777 (EGSA-2026-07, vendor severity 5.1 Medium): the Google Photos picker on the upload page fetched thumbnails through the server with the Google Photos access token, taking the address from the request without checking it and without a form token. A page on another website could make the server send the Google Photos access token to any address, or fetch addresses inside the server's network, while an administrator was logged in; a backend user allowed to manage Event Gallery could do the same directly. Only sites with a Google Photos account configured are affected, from 5.4.0 on. 3) CVE-2026-102778 (EGSA-2026-08, vendor severity 2.3 Low, CNA CVSS 4.0 5.3 Medium): with the Share article links option switched on (off by default), the page a shared image link opens printed the article address from the link unescaped and, for the Image Page with Redirect link type, followed it, allowing a crafted link to run script in the visitor's session or redirect them to another site; from 3.11.6 on. The Joomla CNA published all three CVE records on 5 October 2026. Update to Event Gallery 6.6.0 or later (it requires Joomla 5.4 or Joomla 6 and PHP 8.2). If you override the backend layout tmpl/files/default.php in your template, take over the star and table-icon buttons from the new file. Until you can update, switch Share article links off (Event Gallery options, tab Social) and avoid browsing other sites while logged in to the backend.

CVE-2026-102777 - Event Gallery (Medium)

Sun, 04 Oct 2026 00:00:00 GMT

CVE-2026-102776 - Event Gallery (Medium)

Sun, 04 Oct 2026 00:00:00 GMT

CVE-2026-102775 - Phoca Cart (High)

Thu, 01 Oct 2026 00:00:00 GMT

Phoca Cart before 6.1.9 does not check who is downloading a purchased file. The order download task loads the ordered file by its numeric id and only checks that the download token and order token sent with the request are not empty. It never compares them with the tokens stored for that order. No login is required: an anonymous visitor who sends any non-empty values for both tokens can step through the sequential download ids and fetch the digital products other customers paid for. Only shops that sell downloadable products are exposed, and the per-file download count and day limits still apply. Phoca describes it as an authorisation bypass through a user-controlled key (IDOR) in the order view. Phoca Cart 6.1.9 (1 October 2026) requires the logged-in owner of the order, or both stored tokens matched exactly. The fix has shipped on the 6.x branch only. The current 5.x release (5.2.4), 4.x release (4.0.13) and 3.x release (3.5.8) all have the same unchecked code and no fixed release. Joomla 5 and Joomla 6 sites should install the 6.1.9 package (a Joomla 5 site is offered the 5.x line by the updater, so install pkg_phocacart_v6.1.9.zip by hand). Joomla 3 and Joomla 4 sites have no fix: unpublish downloadable products, or move to Joomla 5 or 6 and Phoca Cart 6.1.9. A CVE has been announced by Phoca but not yet published.

CVE-2026-76570 - JCTables (Critical)

Wed, 30 Sep 2026 00:00:00 GMT

JCTables by JoomCode before 1.21.1 exposes a front-end CRUD controller (index.php?option=com_jctables&task=...) that performs no Joomla token validation and no authentication check on any task. Table names, column names and values are taken straight from the request and concatenated into SQL, and the escaping helper treats any quote-wrapped value as already escaped. An anonymous visitor can read any table in the Joomla database (including the users table) and write to any row, which is enough to take over an administrator account and from there install code on the site. No login or user interaction is needed (CVSS 4.0 10.0 Critical). Update JCTables to 1.21.1 or later, which adds token checks to the write tasks, always quotes values, and limits reads to administrator-configured tables. If you cannot update straight away, disable or uninstall the component until you can, and review administrator accounts for changes.

CVE-2026-102427 - OS CCK (Critical)

Wed, 30 Sep 2026 00:00:00 GMT

OrdaSoft OS CCK versions 1.0.0 to 8.3.15 let anyone upload and run PHP on the site with no login. The front-end upload handler (site/uploader.php, reached through the component's normal routing as task=getContent) has no authentication or permission check. It checks the uploaded file's content with a magic-byte MIME test, but the file-extension allow-list that should restrict the saved name was commented out, so the extension is taken straight from the attacker's filename and the file is written under the site's /images folder, where PHP executes it. A file that starts with valid image bytes and has PHP appended passes the check as a .php file. CVE-2026-102427, CVSS 4.0 10.0 Critical. OrdaSoft fixed this in 8.3.16 by enforcing a jpg/jpeg/png/gif/webp extension allow-list. OrdaSoft's Joomla update manifest still advertises 8.3.14, so sites are not offered 8.3.16 automatically: download it from ordasoft.com and install it by hand. The Pro edition shares the element; its fixed version could not be confirmed. If you cannot update, disable the component, and check /images/com_os_cck*/original/ for any .php file.

CVE-2026-102425 - Balbooa Forms (Critical)

Tue, 29 Sep 2026 00:00:00 GMT

Balbooa Forms before 2.4.3.4 (every release from 1.0.0 to 2.4.3.3, per the Joomla CNA) has five flaws, all reachable by an anonymous visitor through a public form. CVE-2026-102425 (CVSS 4.0 9.5): the optional post-submission PHP action replaces field shortcodes with the raw submitted value before eval(), so a form that uses a PHP action with a visitor-supplied shortcode inside a double-quoted string allows remote code execution. CVE-2026-102424 (8.9): on a form with auto-reply and attach-uploaded-files enabled, a guest can submit a traversal filename such as ../../../../configuration.php and receive any file readable by the site in the auto-reply email. CVE-2026-101127 (8.6): the original upload filename is stored verbatim and rendered into the administrator submission view, giving stored XSS against administrators. CVE-2026-101112 (6.9): removeTmpAttachment deletes any attachment by ID without binding it to the uploader session. CVE-2026-101126 (6.9): final submission trusts client-supplied attachment filenames and display names, allowing cross-session claiming and tampering. Reported by Sergiy Tryzhychynskyi and Lukasz Rybak, coordinated by the Joomla Security Strike Team. Update Balbooa Forms to 2.4.3.4 or later and confirm the component reports 2.4.3.4. If a form sent attachments in auto-replies, rotate the database password in configuration.php. Versions below 2.4.3.2 are also affected by the earlier CVSS 10.0 Balbooa Forms advisories.

CVE-2026-102424 - Balbooa Forms (Critical)

Tue, 29 Sep 2026 00:00:00 GMT

CVE-2026-101127 - Balbooa Forms (Critical)

Tue, 29 Sep 2026 00:00:00 GMT

CVE-2026-101126 - Balbooa Forms (Critical)

Tue, 29 Sep 2026 00:00:00 GMT

CVE-2026-101112 - Balbooa Forms (Critical)

Tue, 29 Sep 2026 00:00:00 GMT

CVE-2026-101111 - Book Library (Medium)

Mon, 28 Sep 2026 00:00:00 GMT

Book Library by OrdaSoft before 6.4.6 echoes the raw title request parameter into a double-quoted HTML attribute on the public book page (site/views/view_book/tmpl/default.php) with no escaping, so a crafted link runs script in the browser of whoever opens it. CVE-2026-101111, CVSS 4.0 5.3 Medium. Update to the newest release OrdaSoft offers.

CVE-2026-101110 - Book Library (Critical)

Mon, 28 Sep 2026 00:00:00 GMT

Book Library by OrdaSoft before 6.4.6 passes the field and direction request parameters of its public book listing through protectInjectionWithoutQuote(), a keyword blacklist that quotes rather than rejects a suspicious value, and then concatenates the result into an unquoted ORDER BY clause where quoting gives no protection. No login is needed. CVE-2026-101110, CVSS 4.0 9.3 Critical. The CVE record names the Free edition; the Pro and ShopPro editions share the element and version numbering. The record title gives the fix as 6.4.6 while its affected range runs to 6.4.6; update to the newest release OrdaSoft offers. If you cannot update, disable the component until you can.

CVE-2026-101109 - Vehicle Manager (Medium)

Mon, 28 Sep 2026 00:00:00 GMT

Vehicle Manager by OrdaSoft before 6.5.8 echoes the title request parameter into a double-quoted HTML attribute on the public vehicle page (task=view) with no output encoding, so a crafted link can inject a script tag that runs in the browser of whoever opens it. CVE-2026-101109, CVSS 4.0 5.3 Medium. Update to 6.5.8 or later.

CVE-2026-101108 - Vehicle Manager (Critical)

Mon, 28 Sep 2026 00:00:00 GMT

Vehicle Manager by OrdaSoft before 6.5.8 reads the order_field and order_direction sort parameters at three public entry points (category listing, search and the all-vehicles listing). The values are escaped, but they are placed into an unquoted ORDER BY clause where escaping gives no protection. No login is needed. CVE-2026-101108, CVSS 4.0 9.3 Critical. The CVE record names the Free edition; the Pro edition shares the element and version numbering. Update to 6.5.8 or later. If you cannot update, disable the component until you can.

CVE-2026-100753 - Real Estate Manager (Medium)

Mon, 28 Sep 2026 00:00:00 GMT

Real Estate Manager by OrdaSoft before 6.7.9 writes the title request parameter back into the leave-a-review form on the public property page with no escaping. A double quote breaks out of the HTML attribute, so a crafted link runs script in the browser of whoever opens it. No login is needed to build the link; the victim has to open it. CVE-2026-100753, CVSS 4.0 5.3 Medium. Update to 6.7.9 or later.

CVE-2026-100752 - Real Estate Manager (Critical)

Mon, 28 Sep 2026 00:00:00 GMT

Real Estate Manager by OrdaSoft before 6.7.9 builds the ORDER BY clause of three public property-listing queries (category browsing, search results and the full property listing) from the request parameter order_field, concatenated into the SQL with no allow-list of column names and no cast. No login is needed. CVE-2026-100752, CVSS 4.0 9.3 Critical. The CVE record names the Free edition; the Pro edition shares the element and version numbering. Update to 6.7.9 or later. If you cannot update, disable the component until you can.

CVE-2026-100751 - Tabs & Accordions (High)

Sun, 27 Sep 2026 00:00:00 GMT

Regular Labs Tabs & Accordions 3.0.0 through 3.1.x is affected by a security issue fixed in 3.2.0 (released 27 September 2026). data-rlta-url attributes accepted executable JavaScript URLs, so script supplied by a content author ran in the browser of a visitor who used the tab or accordion. Exploitation requires the ability to author or edit content, so this is an authenticated stored XSS. The vendor tags the fix PRO, so Free installs on the same version numbers are unlikely to be affected, but mySites.guru cannot tell the two editions apart by version number and flags both. Update to 3.2.0 or later. This is a separate issue from the data-rlta-alias XSS fixed in 3.1.0, so sites that updated to 3.1.0 on 13 September need to update again. No CVE record for this fix has been published yet.

CVE-2026-100750 - Modules Anywhere (High)

Sun, 27 Sep 2026 00:00:00 GMT

Regular Labs Modules Anywhere 9.x is affected by a security issue fixed in 10.0.0 (released 27 September 2026). Module parameter overrides in Modules Anywhere tags were accepted from any content author, so a lower-privileged author could change the feed URLs and other settings of the modules they embedded. 10.0.0 restricts parameter overrides to trusted component and module sources by default. The vendor tags the fix PRO: parameter overrides are a Pro feature, so Free installs on the same version numbers are unlikely to be affected, but mySites.guru cannot tell the two editions apart by version number and flags both. Exploitation requires the ability to author or edit content. Update to 10.0.0 or later. 10.0.0 is flagged by the vendor as a BC BREAK: overrides from sources that are not trusted stop working until they are allowed in the new Process Tags settings. No CVE record for this fix has been published yet.

CVE-2026-97165 - Event Gallery (High)

Sat, 26 Sep 2026 00:00:00 GMT

Event Gallery (Core and Extended) versions before 6.5.0 contain several security flaws, fixed by the vendor in 6.5.0 (26 September 2026) and published by the Joomla CNA as five CVEs on 27 September 2026, each listing 1.0.0 to 6.0.0 as affected. 1) CVE-2026-97164 (CVSS 4.0 7.0 High, vendor advisory EGSA-2026-01): path traversal in the Clear Cache task. A backend user allowed to manage Event Gallery (by default every Administrator, not only Super Users) could use the images parameter of the cache.process task to recursively delete any folder the web server can write to, up to the whole site. 2) CVE-2026-97165 (5.3 Medium, EGSA-2026-02): the Back link of the frontend upload page base64-decoded its return parameter and printed it unvalidated, allowing a crafted link to redirect an editor to another site or run script in their session (reflected XSS and open redirect); the page also printed the event folder name unescaped. 3) CVE-2026-100747 (5.1 Medium, EGSA-2026-03): the upload task in both the backend and the frontend did not check the Joomla form token, so a page on another website could make a logged-in editor or frontend publisher upload images into an event and replace existing images of the same name. Uploads remain restricted to jpg, gif, png, webp and mp4 files with a matching MIME type, so this is a content-integrity attack rather than code execution. 4) CVE-2026-100748 (6.9 Medium, EGSA-2026-04): adding and removing cart items needed no token, so another site could change a visitor's cart. 5) CVE-2026-100749 (5.1 Medium, EGSA-2026-05): the backend clean-up links (orphaned file entries, carts older than 30 days) had no token check. Also hardened in 6.5.0 without a CVE: the email template test-mail button, the Sync Database and Thumbnail Creator tools and three backend AJAX requests lacked token or permission checks, and cart and order identifiers were derived only from the creation timestamp, so anyone knowing roughly when an order was placed could work out its identifier (download links were protected by a separate random token). Update to Event Gallery 6.5.0 or later (it requires Joomla 5.4 or Joomla 6). Carts and orders created before the update keep their old, guessable identifiers. If you override the backend or frontend upload layout (upload/default.php) in your template, update the override, as the upload now requires the token. Until you can update, restrict who has manage and edit permission on Event Gallery.

CVE-2026-97164 - Event Gallery (High)

Sat, 26 Sep 2026 00:00:00 GMT

CVE-2026-97163 - UP Universal Plugin (Critical)

Sat, 26 Sep 2026 00:00:00 GMT

UP (the Universal Plugin for Joomla, plg_content_up) versions 5.0.0 to 6.0.29 have several flaws found and reported by mySites.guru. Unauthenticated: a request to Joomla's AJAX endpoint could trigger installation of action code from GitHub with TLS checks disabled (CVE-2026-97163, CVSS 4.0 10.0), read arbitrary files including configuration.php and create files outside the intended folder (CVE-2026-97161, 9.2), plus SQL injection vectors (CVE-2026-97162, 8.3). The PHP and SQL actions reserved to administrators could be reached by article authors through action-name variants (PHP command injection, CVE-2026-97160, 9.4). Fixed in UP 6.1.0 (Joomla 5.2 to 6.x) and UP 5.2.1 (Joomla 3.10 to 5.1), released 26 Sep 2026. Update to the fixed release for your Joomla version; if you cannot, disable the plugin. Check the plugin folder for action directories or PHP files you did not add.

CVE-2026-97162 - UP Universal Plugin (Critical)

Sat, 26 Sep 2026 00:00:00 GMT

CVE-2026-97161 - UP Universal Plugin (Critical)

Sat, 26 Sep 2026 00:00:00 GMT

CVE-2026-97160 - UP Universal Plugin (Critical)

Sat, 26 Sep 2026 00:00:00 GMT

CVE-2026-94130 - YouTube Gallery (Critical)

Sat, 26 Sep 2026 00:00:00 GMT

YouTube Gallery by JoomlaBoat.com (formerly published under Ivan Komlev and Design Compass corp) versions 1.0.0 to 5.7.2 contain an SQL injection vulnerability in the video search and sorting functionality. No authentication is required: any visitor can inject SQL into read queries, allowing an attacker to extract data from the database, including user accounts and password hashes (CVSS 4.0 9.3 Critical, CWE-89). Fixed in 5.7.3. There is no fix for the old 4.x free line, so sites on 4.x must move to 5.7.3 or later. If you cannot update immediately, disable or uninstall the component and its content plugin and module until you can.

CVE-2026-100749 - Event Gallery (High)

Sat, 26 Sep 2026 00:00:00 GMT

CVE-2026-100748 - Event Gallery (High)

Sat, 26 Sep 2026 00:00:00 GMT

CVE-2026-100747 - Event Gallery (High)

Sat, 26 Sep 2026 00:00:00 GMT

CVE-2026-94132 - AcyMailing (Critical)

Thu, 24 Sep 2026 00:00:00 GMT

AcyMailing 11.1.0 (24 Sep 2026) fixes two security issues that affect the Enterprise edition; Starter installs contain the same code but cannot reach either feature. 1) CVE-2026-94132 (CVSS 4.0 9.5 Critical): mailbox actions and bounce handling using the POP3 (non-IMAP, "pear") connection method saved MIME parts from an incoming email to media/com_acym/upload/ without checking their extension against the allowed-files list, so anyone able to email the monitored mailbox could write a file of any type, including PHP, into the web root (remote code execution). 2) CVE-2026-94131 (CVSS 4.0 8.3 High): before 11.1.0 a subscriber could post a plain string as the value of a file-type custom field instead of uploading a file, and clearing that field later deleted the stored path without checking it stayed inside the upload folder, allowing path traversal to arbitrary file deletion (for example configuration.php). Both CVEs were published by the Joomla CNA on 26 Sep 2026. Update to 11.1.0 or later. Temporary mitigation: remove file-type custom fields from public forms and switch the mailbox connection method to IMAP.

CVE-2026-94131 - AcyMailing (Critical)

Thu, 24 Sep 2026 00:00:00 GMT

CVE-2026-90905 - EasyStore (High)

Wed, 23 Sep 2026 00:00:00 GMT

EasyStore, the JoomShaper ecommerce component for Joomla, is affected by seven flaws fixed in version 3.0.1, found and reported by mySites.guru. (1) Unauthenticated customer data disclosure: the guest checkout lookup returned a guest customer's saved shipping address (name, street address, city, postcode, country and phone number) to any anonymous visitor who supplied that customer's email address, with no login, session or ownership check. (2) Cross-site request forgery on storefront product reviews: the token check was commented out, so a page a logged-in customer visited could submit reviews in their name. Five further flaws need an administrator session and matter when an admin account is phished or shared, or when an admin is lured to a malicious page: SQL injection in media image deletion and in coupon bulk updates (ids concatenated into an IN() clause), no CSRF token check on the administrator AJAX API, an allowEdit() that always returned true and so bypassed Joomla asset permissions on record edits, and a configuration update that rewrote the site sender name and email in configuration.php with no CSRF token or access check. The flaws were reported against 3.0.0 and are present in the 2.x code as well, so every version below 3.0.1 is treated as affected. Update to EasyStore 3.0.1 or later, released 23 September 2026. The customer address disclosure is a silent read that leaves no file changes, so a clean file scan does not show a site was unaffected. CVE-2026-90899, CVE-2026-90900, CVE-2026-90901, CVE-2026-90902, CVE-2026-90903, CVE-2026-90904 and CVE-2026-90905 were published by the Joomla CNA on 23 September 2026, crediting Phil Taylor of mySites.guru.

CVE-2026-90904 - EasyStore (High)

Wed, 23 Sep 2026 00:00:00 GMT

CVE-2026-90903 - EasyStore (High)

Wed, 23 Sep 2026 00:00:00 GMT

CVE-2026-90902 - EasyStore (High)

Wed, 23 Sep 2026 00:00:00 GMT

CVE-2026-90901 - EasyStore (High)

Wed, 23 Sep 2026 00:00:00 GMT

CVE-2026-90900 - EasyStore (High)

Wed, 23 Sep 2026 00:00:00 GMT

CVE-2026-90899 - EasyStore (High)

Wed, 23 Sep 2026 00:00:00 GMT

CVE-2026-88857 - OS Gallery (Critical)

Sun, 20 Sep 2026 00:00:00 GMT

OrdaSoft's OS Gallery component before 6.2.7 has three flaws exploitable by an authenticated user holding the core.manage permission on the gallery component (not administrator-wide trust). CVE-2026-88857 (CVSS 9.4): saveWatermark() writes an uploaded file to a web-accessible path using the client-supplied filename with no extension or content check, so a .php file disguised with an image Content-Type can be uploaded and executed directly. CVE-2026-88856 (CVSS 9.4): updateOSGallery(), reached via task=update_osgallery, passes a JSON request's method field to a live PHP function call using the package field as its argument, with no allow-list, reaching functions such as system, exec, shell_exec and passthru directly. CVE-2026-88855 (CVSS 8.6): saveGallery() concatenates category_names[], catOrderIds and image-ordering values into SQL with no quoting or integer cast, giving full read/write database access including UNION extraction of #__users password hashes. Update to 6.2.7 or later.

CVE-2026-88856 - OS Gallery (Critical)

Sun, 20 Sep 2026 00:00:00 GMT

CVE-2026-88855 - OS Gallery (Critical)

Sun, 20 Sep 2026 00:00:00 GMT

CVE-2026-88854 - OS Gallery (Critical)

Sun, 20 Sep 2026 00:00:00 GMT

CVE-2026-88854 (CVSS 9.3): showSearchResult() and showSearchResultAjax() in OrdaSoft's OS Gallery component before 6.2.7 read the textsearch/searchText request parameter with $input->getVar(), which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a LIKE clause with no escaping. The endpoint requires no login: it is reached via the public, commonly-published mod_osgallery_search search box, so any anonymous site visitor can inject a UNION SELECT and read arbitrary database content, including password hashes. Update to 6.2.7 or later.