mySites.guru Joomla Vulnerability Database

DPCases (com_dpcases) below 3.8.1 - Authenticated Stored XSS and Path Traversal

Thu, 10 Sep 2026 00:00:00 GMT

DPCases before 3.8.1 writes user information into its views without escaping it, so a stored value containing markup becomes live HTML for whoever views the page afterwards. The release also stops icon paths resolving outside the root directory. Update to 3.8.1. No CVE has been assigned at the time of writing; the vendor rates the escaping issue High.

DPCases (com_dpcases) below 3.8.1 - Authenticated Stored XSS and Path Traversal

Thu, 10 Sep 2026 00:00:00 GMT

DPMedia below 1.21.1 - Media Reference Disclosure, Path Traversal and OAuth CSRF

Thu, 10 Sep 2026 00:00:00 GMT

DPMedia below 1.21.1 - Media Reference Disclosure, Path Traversal and OAuth CSRF

Thu, 10 Sep 2026 00:00:00 GMT

DPMedia before 1.21.1 shows DPReferences entries to users who have no access to the media manager, disclosing which media items exist and where they are used. The release also normalises external file names so a path containing dot segments cannot resolve outside the local cache root, adds a state parameter to the OAuth callback for Google and Dropbox account imports so a forged request cannot complete an account connection, and fixes an injection in Google Drive search. The same commit also constrains the post-OAuth redirect target, which was previously taken from a cookie without validation. Update to 1.21.1. DPMedia ships no component, so this rule matches the library; a sibling rule matches the package. No CVE has been assigned at the time of writing; the vendor rates the DPReferences disclosure High.

DPAttachments (com_dpattachments) below 5.8.1 - Unauthenticated Attachment Download, Stored XSS and Path Traversal

Thu, 10 Sep 2026 00:00:00 GMT

DPAttachments before 5.8.1 exposes every attachment to anyone who can guess an id. The front-end download route confirmed only that an attachment record existed and never checked whether the requester was entitled to it, so unpublished attachments, attachments on a restricted view level, and attachments outside their publish window were all downloadable with no login. Attachment ids are sequential integers. 5.8.1 adds a canView() check enforcing edit permission, published state, view access level and the publish up/down window. The release also fixes a stored cross-site scripting flaw in the CSV preview and adds validation of the upload context string used to build a filesystem path. Update to 5.8.1. No CVE has been assigned at the time of writing; the vendor rates the download flaw High.

DPAttachments (com_dpattachments) below 5.8.1 - Unauthenticated Attachment Download, Stored XSS and Path Traversal

Thu, 10 Sep 2026 00:00:00 GMT

DPAttachments before 5.8.1 exposes every attachment to anyone who can guess an id. The front-end download route (index.php?option=com_dpattachments&task=attachment.download&id=N) confirmed only that an attachment record existed and never checked whether the requester was entitled to it, so unpublished attachments, attachments on a restricted view level, and attachments outside their publish window were all downloadable with no login. Attachment ids are sequential integers. The same gap was present on the attachment detail view. 5.8.1 adds a canView() check enforcing edit permission, published state, view access level and the publish up/down window on both paths. The release also fixes a stored cross-site scripting flaw in the CSV preview, where the header row was written out unescaped while the data cells were already escaped, and adds validation of the upload context string, which was used to build a filesystem path and could be tampered with to traverse outside it. Update to 5.8.1. No CVE has been assigned at the time of writing; the vendor rates the download flaw High.

SP Property Finder (com_spproperty) below 4.1.4 - Unauthenticated SQL Injection (full database read) and Mail Relay

Thu, 10 Sep 2026 00:00:00 GMT

SP Property Finder below 4.1.4 contains an unauthenticated blind SQL injection in the public property search and map views, found by mySites.guru and reported privately to JoomShaper on 10 August 2026. Several search filters (the postcode, the sort control, and the price and size range dropdowns) are placed straight into the database query with no quoting, so an anonymous visitor with no login and no token can read any table in the Joomla database, password hashes and the site secret included. The injection is read-only, but reading the session table lets an attacker steal a logged-in administrator's session and take over the site from there, so treat it as serious. A second, lower-severity issue let the property contact and enquiry forms send email to any recipient with a spoofed sender (an unauthenticated mail relay). JoomShaper fixed both in SP Property Finder 4.1.4, released on 10 September 2026, which quotes and casts every filter value, validates the sort control against an allow-list, and derives the mail recipient from a database lookup instead of the request. mySites.guru verified the fix against the build JoomShaper shipped as 4.1.4. The same release also fixed further issues that mySites.guru did not report, tracked as CVE-2026-78084, CVE-2026-78302 and CVE-2026-78303. The reporter's two findings are CVE-2026-78082 (the SQL injection, published by the Joomla CNA at 9.3 Critical and credited to Phil Taylor of mySites.guru) and CVE-2026-78303 (the mail relay). The release also fixed CVE-2026-78083, CVE-2026-78084 and CVE-2026-78302, which mySites.guru did not report. All five CVE records were published at MITRE on 10 September 2026. Update to SP Property Finder 4.1.4 or later from JoomShaper. Updating closes the flaw but does not undo any database read that already happened: if a vulnerable version was public for a while, treat the password hashes and the site secret as potentially known.

JooDatabase (com_joodb) below 5.1 - Unauthenticated SQL Injection

Thu, 03 Sep 2026 00:00:00 GMT

JooDatabase versions before 5.1 pass the front-end cid request parameter straight into a SQL WHERE clause without escaping it. The catalog view reads cid from the request and interpolates each value raw, so an anonymous visitor needs no account, no token and no user interaction to inject arbitrary SQL and read anything the site database holds, including the Joomla user table and its password hashes. CVSS 9.3 Critical (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H), CWE-89. Found by Krzysztof Zajac of CERT PL. Joomla 4, 5 and 6: update to JooDatabase 5.1, released 3 September 2026. The vendor update stream does serve this release to Joomla 4, 5 and 6, so it appears in the normal Update your extensions screen. It can also be installed by hand from https://joodb.feenders.de/index.php/download. Joomla 3 has no fix, and the Joomla backend will not tell those site owners that. The vendor Joomla 3 branch is still com_joodb-3x.zip version 3.2 from May 2022, and its models/catalog.php contains the same unescaped cid interpolation, so it is vulnerable too. The vendor update stream offers Joomla 3 sites only a 3.2.0 block, which is lower than most builds people actually run, so a Joomla 3 site sitting on 3.2.1, 3.6.1, 3.9.x or 3.13 is offered nothing at all and reads as up to date forever, while a site on 3.2 or older is offered an update that still contains the bug. Either way the backend is not a reliable signal here. Those sites are stranded rather than behind: the real remediation is migrating to Joomla 4 or later and installing JooDatabase 5.1. Until then, unpublish or uninstall the component, or block the front-end catalog view at the web server or WAF. Note on the CVE wording: the record names the product JooDatabase Lite, but the vendor stopped shipping separate Lite and Pro editions at the start of 2022 and everything since is a single free release, so this applies to any JooDatabase install in range. The CVE structured version list also states 1.0-5.0.0 while its own title and description say below 5.1.0. The vendor release and the shipped code resolve that in favour of below 5.1: the 5.1 zip served by the update stream carries the db->quote fix, and the 5.0.2 build that preceded it still has the raw interpolation, so 5.0.1 and 5.0.2 are vulnerable.

miniOrange SCIM User Provisioning (com_miniorange_scim) free edition 1.0.0 to 4.0.5 - Unauthenticated Arbitrary Extension Uninstallation (Denial of Service)

Mon, 31 Aug 2026 00:00:00 GMT

CERT PL (Krzysztof Zajac) reported that a large set of miniOrange Joomla extensions expose an endpoint with a missing authentication check, letting an unauthenticated attacker uninstall any extension installed on the site (CWE-284 Improper Access Control, CVSS 4.0 base score 8.8 High, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). Uninstalling an extension takes its functionality offline and, on most Joomla extensions, runs its uninstall script and drops its database tables, so this is a remote, unauthenticated, destructive denial of service that can be pointed at any component, module or plugin on the site - security and login extensions included. There is no confidentiality impact: the attacker deletes, it does not read. CVE-2026-78074 names 23 miniOrange Joomla extensions and states explicitly that ONLY THE FREE editions are affected. This rule covers one of them, "SCIM User Provisioning for Joomla (free)", at the CVE's stated affected range 1.0.0-4.0.5. miniOrange numbers its paid editions in decades on the same element (builds such as 12.x, 21.x, 22.x, 32.x, 34.x and 44.x are in the wild on these components), and those sit above this ceiling, so they are deliberately not flagged - consistent with the CVE limiting the flaw to the free editions. FIXED: update miniOrange SCIM User Provisioning to 4.0.6 or later. miniOrange released the fix on 31 August 2026. This was verified independently of the vendor's own claim: the Joomla Extensions Directory listing for this extension shows 4.0.6 with that release date. miniOrange ship more than one SCIM extension for Joomla and the standalone scim-user-provisioning plugin is versioned on a separate line, so this rule is deliberately confined to the com_miniorange_scim component. This rule's upper bound is the last version known to be AFFECTED, not the fix version, so any site inside the range still needs the update. If you cannot update immediately, uninstall the extension where it is not actually in use, and otherwise block unauthenticated access to the component's endpoints at the web application firewall or web server.

miniOrange Restrict Files / Folders / Media Access (com_miniorange_mediarestriction) free edition 1.0.0 to 3.7 - Unauthenticated Arbitrary Extension Uninstallation (Denial of Service)

Mon, 31 Aug 2026 00:00:00 GMT

CERT PL (Krzysztof Zajac) reported that a large set of miniOrange Joomla extensions expose an endpoint with a missing authentication check, letting an unauthenticated attacker uninstall any extension installed on the site (CWE-284 Improper Access Control, CVSS 4.0 base score 8.8 High, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). Uninstalling an extension takes its functionality offline and, on most Joomla extensions, runs its uninstall script and drops its database tables, so this is a remote, unauthenticated, destructive denial of service that can be pointed at any component, module or plugin on the site - security and login extensions included. There is no confidentiality impact: the attacker deletes, it does not read. CVE-2026-78074 names 23 miniOrange Joomla extensions and states explicitly that ONLY THE FREE editions are affected. This rule covers one of them, "Restrict Files / Folders / Media Access for Joomla (free)", at the CVE's stated affected range 1.0.0-3.7. miniOrange numbers its paid editions in decades on the same element (builds such as 12.x, 21.x, 22.x, 32.x, 34.x and 44.x are in the wild on these components), and those sit above this ceiling, so they are deliberately not flagged - consistent with the CVE limiting the flaw to the free editions. FIXED: update miniOrange Restrict Files / Folders / Media Access to 3.8 or later. miniOrange released the fix on 31 August 2026. This was verified independently of the vendor's own claim: the Joomla Extensions Directory listing for this extension shows 3.8 with that release date. miniOrange also market this extension as the Joomla Content Access Manager, which is the display name connected sites report for it. This rule's upper bound is the last version known to be AFFECTED, not the fix version, so any site inside the range still needs the update. If you cannot update immediately, uninstall the extension where it is not actually in use, and otherwise block unauthenticated access to the component's endpoints at the web application firewall or web server.

miniOrange OAuth Server (com_miniorange_oauth) free edition 1.0.0 to 5.1.5 - Unauthenticated Arbitrary Extension Uninstallation (Denial of Service)

Mon, 31 Aug 2026 00:00:00 GMT

CERT PL (Krzysztof Zajac) reported that a large set of miniOrange Joomla extensions expose an endpoint with a missing authentication check, letting an unauthenticated attacker uninstall any extension installed on the site (CWE-284 Improper Access Control, CVSS 4.0 base score 8.8 High, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). Uninstalling an extension takes its functionality offline and, on most Joomla extensions, runs its uninstall script and drops its database tables, so this is a remote, unauthenticated, destructive denial of service that can be pointed at any component, module or plugin on the site - security and login extensions included. There is no confidentiality impact: the attacker deletes, it does not read. CVE-2026-78074 names 23 miniOrange Joomla extensions and states explicitly that ONLY THE FREE editions are affected. This rule covers one of them, "OAuth Server for Joomla (free)", at the CVE's stated affected range 1.0.0-5.1.5. miniOrange numbers its paid editions in decades on the same element (builds such as 12.x, 21.x, 22.x, 32.x, 34.x and 44.x are in the wild on these components), and those sit above this ceiling, so they are deliberately not flagged - consistent with the CVE limiting the flaw to the free editions. FIXED: update miniOrange OAuth Server to 5.1.6 or later. miniOrange released the fix on 31 August 2026. This was verified independently of the vendor's own claim: the Joomla Extensions Directory listing for this extension shows 5.1.6 with that release date. This product ships under the same com_miniorange_oauth element as the OAuth Client, so it is matched on the display name rather than the element alone. This rule's upper bound is the last version known to be AFFECTED, not the fix version, so any site inside the range still needs the update. If you cannot update immediately, uninstall the extension where it is not actually in use, and otherwise block unauthenticated access to the component's endpoints at the web application firewall or web server.

miniOrange Login with Azure AD / OAuth OIDC SSO (com_miniorange_oauth) free edition 1.0.0 to 1.2.2 - Unauthenticated Arbitrary Extension Uninstallation (Denial of Service)

Mon, 31 Aug 2026 00:00:00 GMT

CERT PL (Krzysztof Zajac) reported that a large set of miniOrange Joomla extensions expose an endpoint with a missing authentication check, letting an unauthenticated attacker uninstall any extension installed on the site (CWE-284 Improper Access Control, CVSS 4.0 base score 8.8 High, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). Uninstalling an extension takes its functionality offline and, on most Joomla extensions, runs its uninstall script and drops its database tables, so this is a remote, unauthenticated, destructive denial of service that can be pointed at any component, module or plugin on the site - security and login extensions included. There is no confidentiality impact: the attacker deletes, it does not read. CVE-2026-78074 names 23 miniOrange Joomla extensions and states explicitly that ONLY THE FREE editions are affected. This rule covers one of them, "OAuth Single Sign-On - OIDC SSO | Login with Azure AD (free)", at the CVE's stated affected range 1.0.0-1.2.2. miniOrange numbers its paid editions in decades on the same element (builds such as 12.x, 21.x, 22.x, 32.x, 34.x and 44.x are in the wild on these components), and those sit above this ceiling, so they are deliberately not flagged - consistent with the CVE limiting the flaw to the free editions. FIXED: update OAuth Single Sign-On - OIDC SSO / Login with Azure AD to 1.2.3 or later. miniOrange released the fix on 31 August 2026. This was verified independently of the vendor's own claim: the Joomla Extensions Directory listing for this extension shows 1.2.3 with that release date. This product ships under the same com_miniorange_oauth element as the OAuth Client but on its own 1.x numbering, so it is matched on the display name rather than the element alone. This rule's upper bound is the last version known to be AFFECTED, not the fix version, so any site inside the range still needs the update. If you cannot update immediately, uninstall the extension where it is not actually in use, and otherwise block unauthenticated access to the component's endpoints at the web application firewall or web server.

J2Store / J2Commerce (com_j2store) 4.1.6 (Joomla 4.1 branch) - Unauthenticated Payment Callback Forgery and Cart Tampering, Backend Privilege Escalation, Guest Address IDOR and Reflected XSS (5 CVEs)

Mon, 31 Aug 2026 00:00:00 GMT

J2Store / J2Commerce 4.1.6 is affected by five vulnerabilities in com_j2store, disclosed by Phil Taylor (mySites.guru) and fixed by J2Commerce on 31 August 2026. CVE-2026-78069 (CVSS 9.5, Critical): the administrator Apps controller instantiates app-plugin controllers through an appTask delegation path with no com_j2store ACL check anywhere in the code, and the backend node of fof.xml declares no view ACL at all, so FOF defaults an unmatched task to allow rather than deny. Any authenticated Joomla backend user, holding no J2Store permission whatsoever, can trigger #__j2store_* table truncation and traversal-based SQL file execution; only the Joomla core administrator login wall keeps anonymous visitors out, and that checks nothing about com_j2store permissions. CVE-2026-78064 (CVSS 8.8, High): the carts view inherits the generic FOF save task under a wildcard true ACL in fof.xml, and FOF enforces CSRF tokens only on backend HTML requests, not on frontend format=raw requests, so an unauthenticated POST can insert cart rows with an attacker-chosen user_id or session_id, or overwrite an existing row by id. CVE-2026-77999 (CVSS 8.7, High): the PayPal IPN listener treated UNVERIFIED and any non-INVALID response as valid, made its verification request with CURLOPT_SSL_VERIFYPEER disabled, and stored the verdict in a field nothing downstream read, so processing continued regardless of the outcome; separately, omitting mc_gross from the POST body skipped the paid-amount comparison entirely. Unauthenticated requests could confirm orders that were never paid for, or fail legitimate ones. CVE-2026-78065 (CVSS 7.1, High): editAddress() redirected non-owners away only when the loaded address row had a non-empty user_id, and guest checkout rows have none, so any logged-in account guessing a small sequential address_id was shown a guest customer full name, street address and phone number prefilled into the edit form. CVE-2026-78000 (CVSS 5.3, Medium): filter_tag, pricefrom and priceto are echoed unescaped into a hidden input value attribute by J2Html::input(), across all six shipped product-tags templates, giving reflected XSS from a crafted link with no click beyond the initial navigation. FIX: update to 4.1.7 on this 4.1.x branch (the equivalent fixes are 3.3.22 on the Joomla 3 branch and 4.0.22 on 4.0.x). If you cannot update immediately: disable PayPal, or watch pending orders for CONFIRMED or FAILED transitions with no matching PayPal transaction; disable guest checkout; and review every Joomla backend account regardless of privilege level, because the Apps controller issue needs a backend login but no J2Store permission. All five CVE records were published by the Joomla CNA on 3 September 2026 and all five credit Phil Taylor, mySites.guru. The affected ranges are unchanged. Four scores match the vendor advisory; CVE-2026-78069 was raised from the vendor's 9.4 to 9.5 Critical, and the published vector reads AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, scoring the backend login as an attack requirement (AT:P) rather than a privilege (PR:L).

J2Store / J2Commerce (com_j2store) 4.0.21 (Joomla 4.0 branch) - Unauthenticated Payment Callback Forgery and Cart Tampering, Backend Privilege Escalation, Guest Address IDOR and Reflected XSS (5 CVEs)

Mon, 31 Aug 2026 00:00:00 GMT

J2Store / J2Commerce 4.0.21 is affected by five vulnerabilities in com_j2store, disclosed by Phil Taylor (mySites.guru) and fixed by J2Commerce on 31 August 2026. CVE-2026-78069 (CVSS 9.5, Critical): the administrator Apps controller instantiates app-plugin controllers through an appTask delegation path with no com_j2store ACL check anywhere in the code, and the backend node of fof.xml declares no view ACL at all, so FOF defaults an unmatched task to allow rather than deny. Any authenticated Joomla backend user, holding no J2Store permission whatsoever, can trigger #__j2store_* table truncation and traversal-based SQL file execution; only the Joomla core administrator login wall keeps anonymous visitors out, and that checks nothing about com_j2store permissions. CVE-2026-78064 (CVSS 8.8, High): the carts view inherits the generic FOF save task under a wildcard true ACL in fof.xml, and FOF enforces CSRF tokens only on backend HTML requests, not on frontend format=raw requests, so an unauthenticated POST can insert cart rows with an attacker-chosen user_id or session_id, or overwrite an existing row by id. CVE-2026-77999 (CVSS 8.7, High): the PayPal IPN listener treated UNVERIFIED and any non-INVALID response as valid, made its verification request with CURLOPT_SSL_VERIFYPEER disabled, and stored the verdict in a field nothing downstream read, so processing continued regardless of the outcome; separately, omitting mc_gross from the POST body skipped the paid-amount comparison entirely. Unauthenticated requests could confirm orders that were never paid for, or fail legitimate ones. CVE-2026-78065 (CVSS 7.1, High): editAddress() redirected non-owners away only when the loaded address row had a non-empty user_id, and guest checkout rows have none, so any logged-in account guessing a small sequential address_id was shown a guest customer full name, street address and phone number prefilled into the edit form. CVE-2026-78000 (CVSS 5.3, Medium): filter_tag, pricefrom and priceto are echoed unescaped into a hidden input value attribute by J2Html::input(), across all six shipped product-tags templates, giving reflected XSS from a crafted link with no click beyond the initial navigation. FIX: update to 4.0.22 on this 4.0.x branch (the equivalent fixes are 3.3.22 on the Joomla 3 branch and 4.1.7 on 4.1.x). If you cannot update immediately: disable PayPal, or watch pending orders for CONFIRMED or FAILED transitions with no matching PayPal transaction; disable guest checkout; and review every Joomla backend account regardless of privilege level, because the Apps controller issue needs a backend login but no J2Store permission. All five CVE records were published by the Joomla CNA on 3 September 2026 and all five credit Phil Taylor, mySites.guru. The affected ranges are unchanged. Four scores match the vendor advisory; CVE-2026-78069 was raised from the vendor's 9.4 to 9.5 Critical, and the published vector reads AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, scoring the backend login as an attack requirement (AT:P) rather than a privilege (PR:L).

J2Store / J2Commerce (com_j2store) 3.3.21 (Joomla 3 branch) - Unauthenticated Payment Callback Forgery and Cart Tampering, Backend Privilege Escalation, Guest Address IDOR and Reflected XSS (5 CVEs)

Mon, 31 Aug 2026 00:00:00 GMT

J2Store 3.3.21 on the Joomla 3 branch is affected by five vulnerabilities in com_j2store, disclosed by Phil Taylor (mySites.guru) and fixed by J2Commerce on 31 August 2026. CVE-2026-78069 (CVSS 9.5, Critical): the administrator Apps controller instantiates app-plugin controllers through an appTask delegation path with no com_j2store ACL check anywhere in the code, and the backend node of fof.xml declares no view ACL at all, so FOF defaults an unmatched task to allow rather than deny. Any authenticated Joomla backend user, holding no J2Store permission whatsoever, can trigger #__j2store_* table truncation and traversal-based SQL file execution; only the Joomla core administrator login wall keeps anonymous visitors out, and that checks nothing about com_j2store permissions. CVE-2026-78064 (CVSS 8.8, High): the carts view inherits the generic FOF save task under a wildcard true ACL in fof.xml, and FOF enforces CSRF tokens only on backend HTML requests, not on frontend format=raw requests, so an unauthenticated POST can insert cart rows with an attacker-chosen user_id or session_id, or overwrite an existing row by id. CVE-2026-77999 (CVSS 8.7, High): the PayPal IPN listener treated UNVERIFIED and any non-INVALID response as valid, made its verification request with CURLOPT_SSL_VERIFYPEER disabled, and stored the verdict in a field nothing downstream read, so processing continued regardless of the outcome; separately, omitting mc_gross from the POST body skipped the paid-amount comparison entirely. Unauthenticated requests could confirm orders that were never paid for, or fail legitimate ones. CVE-2026-78065 (CVSS 7.1, High): editAddress() redirected non-owners away only when the loaded address row had a non-empty user_id, and guest checkout rows have none, so any logged-in account guessing a small sequential address_id was shown a guest customer full name, street address and phone number prefilled into the edit form. CVE-2026-78000 (CVSS 5.3, Medium): filter_tag, pricefrom and priceto are echoed unescaped into a hidden input value attribute by J2Html::input(), across all six shipped product-tags templates, giving reflected XSS from a crafted link with no click beyond the initial navigation. FIX: update to 3.3.22 on this Joomla 3 branch (the equivalent fixes are 4.0.22 on 4.0.x and 4.1.7 on 4.1.x). If you cannot update immediately: disable PayPal, or watch pending orders for CONFIRMED or FAILED transitions with no matching PayPal transaction; disable guest checkout; and review every Joomla backend account regardless of privilege level, because the Apps controller issue needs a backend login but no J2Store permission. All five CVE records were published by the Joomla CNA on 3 September 2026 and all five credit Phil Taylor, mySites.guru. The affected ranges are unchanged. Four scores match the vendor advisory; CVE-2026-78069 was raised from the vendor's 9.4 to 9.5 Critical, and the published vector reads AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, scoring the backend login as an attack requirement (AT:P) rather than a privilege (PR:L).

miniOrange Two Factor Authentication (com_miniorange_twofa) free edition 1.0.0 to 5.0.9 - Unauthenticated Arbitrary Extension Uninstallation (Denial of Service)

Mon, 31 Aug 2026 00:00:00 GMT

CERT PL (Krzysztof Zajac) reported that a large set of miniOrange Joomla extensions expose an endpoint with a missing authentication check, letting an unauthenticated attacker uninstall any extension installed on the site (CWE-284 Improper Access Control, CVSS 4.0 base score 8.8 High, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). Uninstalling an extension takes its functionality offline and, on most Joomla extensions, runs its uninstall script and drops its database tables, so this is a remote, unauthenticated, destructive denial of service that can be pointed at any component, module or plugin on the site - security and login extensions included. There is no confidentiality impact: the attacker deletes, it does not read. CVE-2026-78074 names 23 miniOrange Joomla extensions and states explicitly that ONLY THE FREE editions are affected. This rule covers one of them, "Two Factor Authentication 2FA for Joomla (free)", at the CVE's stated affected range 1.0.0-5.0.9. miniOrange numbers its paid editions in decades on the same element (builds such as 12.x, 21.x, 22.x, 32.x, 34.x and 44.x are in the wild on these components), and those sit above this ceiling, so they are deliberately not flagged - consistent with the CVE limiting the flaw to the free editions. FIXED: update miniOrange Two Factor Authentication to 5.0.10 or later. miniOrange released the fix on 1 September 2026. This was verified independently of the vendor's own claim: the Joomla Extensions Directory listing for this extension shows 5.0.10 with that release date. The CVE record originally contradicted itself on this one, giving 5.1.0 in its HTML solution block against 5.0.10 in the plain-text one. We reported it to the Joomla CNA on 4 September 2026 and the record was corrected to 5.0.10 the same morning, which is what miniOrange gave in writing and what the directory shows. This release came a day later than the rest of the set. This rule's upper bound is the last version known to be AFFECTED, not the fix version, so any site inside the range still needs the update. If you cannot update immediately, uninstall the extension where it is not actually in use, and otherwise block unauthenticated access to the component's endpoints at the web application firewall or web server.

miniOrange LDAP Integration (com_miniorange_dirsync) free edition 1.0.0 to 6.4.7 - Unauthenticated Arbitrary Extension Uninstallation (Denial of Service)

Mon, 31 Aug 2026 00:00:00 GMT

CERT PL (Krzysztof Zajac) reported that a large set of miniOrange Joomla extensions expose an endpoint with a missing authentication check, letting an unauthenticated attacker uninstall any extension installed on the site (CWE-284 Improper Access Control, CVSS 4.0 base score 8.8 High, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). Uninstalling an extension takes its functionality offline and, on most Joomla extensions, runs its uninstall script and drops its database tables, so this is a remote, unauthenticated, destructive denial of service that can be pointed at any component, module or plugin on the site - security and login extensions included. There is no confidentiality impact: the attacker deletes, it does not read. CVE-2026-78074 names 23 miniOrange Joomla extensions and states explicitly that ONLY THE FREE editions are affected. This rule covers one of them, "LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login (free)", at the CVE's stated affected range 1.0.0-6.4.7. miniOrange numbers its paid editions in decades on the same element (builds such as 12.x, 21.x, 22.x, 32.x, 34.x and 44.x are in the wild on these components), and those sit above this ceiling, so they are deliberately not flagged - consistent with the CVE limiting the flaw to the free editions. FIXED: update miniOrange LDAP Integration to 6.4.8 or later. miniOrange released the fix on 31 August 2026. This was verified independently of the vendor's own claim: the Joomla Extensions Directory listing for this extension shows 6.4.8 with that release date. This rule's upper bound is the last version known to be AFFECTED, not the fix version, so any site inside the range still needs the update. If you cannot update immediately, uninstall the extension where it is not actually in use, and otherwise block unauthenticated access to the component's endpoints at the web application firewall or web server.

miniOrange Keycloak User Sync (com_miniorange_keycloaksync) free edition 1.0.0 to 1.1.0 - Unauthenticated Arbitrary Extension Uninstallation (Denial of Service)

Mon, 31 Aug 2026 00:00:00 GMT

CERT PL (Krzysztof Zajac) reported that a large set of miniOrange Joomla extensions expose an endpoint with a missing authentication check, letting an unauthenticated attacker uninstall any extension installed on the site (CWE-284 Improper Access Control, CVSS 4.0 base score 8.8 High, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). Uninstalling an extension takes its functionality offline and, on most Joomla extensions, runs its uninstall script and drops its database tables, so this is a remote, unauthenticated, destructive denial of service that can be pointed at any component, module or plugin on the site - security and login extensions included. There is no confidentiality impact: the attacker deletes, it does not read. CVE-2026-78074 names 23 miniOrange Joomla extensions and states explicitly that ONLY THE FREE editions are affected. This rule covers one of them, "Keycloak user sync / User management (free)", at the CVE's stated affected range 1.0.0-1.1.0. miniOrange numbers its paid editions in decades on the same element (builds such as 12.x, 21.x, 22.x, 32.x, 34.x and 44.x are in the wild on these components), and those sit above this ceiling, so they are deliberately not flagged - consistent with the CVE limiting the flaw to the free editions. FIXED: update miniOrange Keycloak User Sync to 1.1.1 or later. miniOrange released the fix on 31 August 2026. This was verified independently of the vendor's own claim: the Joomla Extensions Directory listing for this extension shows 1.1.1 with that release date. This rule's upper bound is the last version known to be AFFECTED, not the fix version, so any site inside the range still needs the update. If you cannot update immediately, uninstall the extension where it is not actually in use, and otherwise block unauthenticated access to the component's endpoints at the web application firewall or web server.

miniOrange Custom API (com_miniorange_customapi) free edition 1.0.0 to 4.2 - Unauthenticated Arbitrary Extension Uninstallation (Denial of Service)

Mon, 31 Aug 2026 00:00:00 GMT

CERT PL (Krzysztof Zajac) reported that a large set of miniOrange Joomla extensions expose an endpoint with a missing authentication check, letting an unauthenticated attacker uninstall any extension installed on the site (CWE-284 Improper Access Control, CVSS 4.0 base score 8.8 High, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). Uninstalling an extension takes its functionality offline and, on most Joomla extensions, runs its uninstall script and drops its database tables, so this is a remote, unauthenticated, destructive denial of service that can be pointed at any component, module or plugin on the site - security and login extensions included. There is no confidentiality impact: the attacker deletes, it does not read. CVE-2026-78074 names 23 miniOrange Joomla extensions and states explicitly that ONLY THE FREE editions are affected. This rule covers one of them, "Custom API for Joomla (free)", at the CVE's stated affected range 1.0.0-4.2. miniOrange numbers its paid editions in decades on the same element (builds such as 12.x, 21.x, 22.x, 32.x, 34.x and 44.x are in the wild on these components), and those sit above this ceiling, so they are deliberately not flagged - consistent with the CVE limiting the flaw to the free editions. FIXED: update miniOrange Custom API to 4.3 or later. miniOrange released the fix on 31 August 2026. This was verified independently of the vendor's own claim: the Joomla Extensions Directory listing for this extension shows 4.3 with that release date. Connected sites have already been observed reporting 4.3. This rule's upper bound is the last version known to be AFFECTED, not the fix version, so any site inside the range still needs the update. If you cannot update immediately, uninstall the extension where it is not actually in use, and otherwise block unauthenticated access to the component's endpoints at the web application firewall or web server.

miniOrange Import Export Users (com_miniorange_importexportusers) free edition 1.0.0 to 4.6 - Unauthenticated Arbitrary Extension Uninstallation (Denial of Service)

Mon, 31 Aug 2026 00:00:00 GMT

CERT PL (Krzysztof Zajac) reported that a large set of miniOrange Joomla extensions expose an endpoint with a missing authentication check, letting an unauthenticated attacker uninstall any extension installed on the site (CWE-284 Improper Access Control, CVSS 4.0 base score 8.8 High, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). Uninstalling an extension takes its functionality offline and, on most Joomla extensions, runs its uninstall script and drops its database tables, so this is a remote, unauthenticated, destructive denial of service that can be pointed at any component, module or plugin on the site - security and login extensions included. There is no confidentiality impact: the attacker deletes, it does not read. CVE-2026-78074 names 23 miniOrange Joomla extensions and states explicitly that ONLY THE FREE editions are affected. This rule covers one of them, "Import Export Users for Joomla (free)", at the CVE's stated affected range 1.0.0-4.6. miniOrange numbers its paid editions in decades on the same element (builds such as 12.x, 21.x, 22.x, 32.x, 34.x and 44.x are in the wild on these components), and those sit above this ceiling, so they are deliberately not flagged - consistent with the CVE limiting the flaw to the free editions. FIXED: update miniOrange Import Export Users to 4.7 or later. miniOrange released the fix on 31 August 2026. This was verified independently of the vendor's own claim: the Joomla Extensions Directory listing for this extension shows 4.7 with that release date. The CVE record originally truncated this mid-number in its solution text ("Import Export Users for Joomla - 4."). We reported that to the Joomla CNA on 4 September 2026 and the record was corrected to 4.7 the same morning, which matches what miniOrange gave in writing and what the directory shows. This rule's upper bound is the last version known to be AFFECTED, not the fix version, so any site inside the range still needs the update. If you cannot update immediately, uninstall the extension where it is not actually in use, and otherwise block unauthenticated access to the component's endpoints at the web application firewall or web server.

miniOrange OAuth Client (com_miniorange_oauth) free edition 1.0.0 to 3.2.0 - Unauthenticated Arbitrary Extension Uninstallation (Denial of Service)

Mon, 31 Aug 2026 00:00:00 GMT

CERT PL (Krzysztof Zajac) reported that a large set of miniOrange Joomla extensions expose an endpoint with a missing authentication check, letting an unauthenticated attacker uninstall any extension installed on the site (CWE-284 Improper Access Control, CVSS 4.0 base score 8.8 High, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). Uninstalling an extension takes its functionality offline and, on most Joomla extensions, runs its uninstall script and drops its database tables, so this is a remote, unauthenticated, destructive denial of service that can be pointed at any component, module or plugin on the site - security and login extensions included. There is no confidentiality impact: the attacker deletes, it does not read. CVE-2026-78074 names 23 miniOrange Joomla extensions and states explicitly that ONLY THE FREE editions are affected. This rule covers one of them, "miniOrange Oauth Client (free)", at the CVE's stated affected range 1.0.0-3.2.0. miniOrange numbers its paid editions in decades on the same element (builds such as 12.x, 21.x, 22.x, 32.x, 34.x and 44.x are in the wild on these components), and those sit above this ceiling, so they are deliberately not flagged - consistent with the CVE limiting the flaw to the free editions. FIXED: update the miniOrange OAuth Client to 3.2.1 or later. miniOrange released the fix on 31 August 2026. This was verified independently of the vendor's own claim: the Joomla Extensions Directory listing for this extension shows 3.2.1 with that release date. Note that 3.2.1 supersedes the 3.2.0 that fixed the separate CVE-2026-77995 account takeover, so a site sitting on 3.2.0 is patched for that flaw but still exposed to this one. This rule's upper bound is the last version known to be AFFECTED, not the fix version, so any site inside the range still needs the update. If you cannot update immediately, uninstall the extension where it is not actually in use, and otherwise block unauthenticated access to the component's endpoints at the web application firewall or web server.

miniOrange SAML SSO (com_miniorange_saml) free edition 1.0.0 to 11.0.2 - Unauthenticated Arbitrary Extension Uninstallation (Denial of Service)

Mon, 31 Aug 2026 00:00:00 GMT

CERT PL (Krzysztof Zajac) reported that a large set of miniOrange Joomla extensions expose an endpoint with a missing authentication check, letting an unauthenticated attacker uninstall any extension installed on the site (CWE-284 Improper Access Control, CVSS 4.0 base score 8.8 High, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). Uninstalling an extension takes its functionality offline and, on most Joomla extensions, runs its uninstall script and drops its database tables, so this is a remote, unauthenticated, destructive denial of service that can be pointed at any component, module or plugin on the site - security and login extensions included. There is no confidentiality impact: the attacker deletes, it does not read. CVE-2026-78074 names 23 miniOrange Joomla extensions and states explicitly that ONLY THE FREE editions are affected. This rule covers one of them, "SAML SSO for Joomla (free)", at the CVE's stated affected range 1.0.0-11.0.2. miniOrange numbers its paid editions in decades on the same element (builds such as 12.x, 21.x, 22.x, 32.x, 34.x and 44.x are in the wild on these components), and those sit above this ceiling, so they are deliberately not flagged - consistent with the CVE limiting the flaw to the free editions. FIXED: update miniOrange SAML SSO for Joomla to 11.0.3 or later. miniOrange released the fix on 31 August 2026. This was verified independently of the vendor's own claim: the Joomla Extensions Directory listing for this extension shows 11.0.3 with that release date. Connected sites have already been observed reporting 11.0.3. This rule's upper bound is the last version known to be AFFECTED, not the fix version, so any site inside the range still needs the update. If you cannot update immediately, uninstall the extension where it is not actually in use, and otherwise block unauthenticated access to the component's endpoints at the web application firewall or web server.

Helix Ultimate (shaper_helixultimate) 2.2.7 to 2.2.9 - Media Upload Bypass, Path Traversal, Broken Access Control and Stored XSS

Mon, 31 Aug 2026 00:00:00 GMT

JoomShaper released Helix Ultimate 2.2.10 on 27 August 2026 as a security update, and states that all versions prior to 2.2.10 are affected. It grades the issues High / Medium. THIS ROW IS THE TEMPLATE (shaper_helixultimate), which is installed separately from the System - Helix Ultimate Framework plugin, does NOT appear in Joomla Updates, and must be downloaded from JoomShaper and installed by hand - updating the plugin alone does not clear it. Template-side fixes in 2.2.10 are: strict heading tag, CSS colour format and attribute validation in the Page Title feature (templates/shaper_helixultimate/features/title.php); hardening of index.php; and template style installer changes that scope parameter migrations by style ID and clean up obsolete SCSSPHP vendor files. The release also fixes, in the paired plugin: com_media permission enforcement on media AJAX endpoints, image upload MIME and binary raster verification, canonical realpath media path validation with null-byte detection, Live Preview and Coming Soon bypass restricted to authenticated users with template edit rights, object-level authorization on frontend article attribute saves, Mega Menu edit permission checks and JSON layout XSS sanitisation, and output encoding on video, audio and social sharing markup. The Joomla CNA published five CVEs for this release on 31 August 2026, every one of them with the affected range 1.0-2.2.9: CVE-2026-78078 (8.9 High, privileged file upload bypass via content spoofing - upload validation checked only the file extension and basic size, so a non-image disguised with a raster extension was accepted; 2.2.10 adds strict MIME verification and GD binary raster decoding that fails closed), CVE-2026-78077 (8.6 High, stored XSS in the Mega Menu layout container and embed inputs - unsanitised column and item configuration values held in the Mega Menu layout JSON were rendered without complete contextual escaping), CVE-2026-78079 (5.3 Medium, open redirect - the return redirect parameter accepted any Base64 string without checking the resolved target with Uri::isInternal), CVE-2026-78075 (5.1 Medium, broken object-level authorization in Blog::remove_image - the check validated the article id passed in the request but never confirmed that the supplied image path belonged to that article, letting an author delete arbitrary files under /images/; reported by Phil Taylor of mySites.guru) and CVE-2026-78076 (5.1 Medium, missing item-level and menu-level authorization on the save-megamenu-settings AJAX endpoint, so an authenticated user could rewrite layout parameters for arbitrary menu items). Four of the five score PR:H and need an authenticated, privileged account; only the open redirect (CVE-2026-78079) is PR:N, and that one also needs user interaction. So the original judgement stands: this is not an unauthenticated remote attack surface, unlike CVE-2026-57829 / CVE-2026-57830 below. One trap when reading the CNA records: CVE-2026-78079 is TITLED 'Privileged File Upload Bypass via Content Spoofing', a straight duplicate of CVE-2026-78078's title, while its description and its CVSS vector are the open redirect. The description is the correct half. This is the same Mega Menu surface as CVE-2026-57829 and CVE-2026-57830, exploited in the wild in July 2026, so treat it as urgent. Action: update BOTH the Helix Ultimate template and the Helix Ultimate plugin to 2.2.10 or later. Joomla 3 sites cannot install 2.2.10 - JoomShaper ships a separate J3 security patch (helixultimate_j3_security_fixes, currently v1.0.3, released 31 August 2026) which leaves the reported template version at 2.1.4-j3sec, so a J3 install gives no version evidence of its patch level and is deliberately outside this range.

Helix Ultimate Framework (helixultimate) 2.2.7 to 2.2.9 - Media Upload Bypass, Path Traversal, Broken Access Control and Stored XSS

Mon, 31 Aug 2026 00:00:00 GMT

JoomShaper released Helix Ultimate 2.2.10 on 27 August 2026 as a security update, and states that all versions prior to 2.2.10 are affected. It grades the issues High / Medium. The fixes in this release are: strict com_media permission enforcement (core.manage, core.create, core.delete) across every media AJAX endpoint; binary raster and MIME content verification on image uploads to block upload filter bypasses; canonical realpath validation and null-byte detection on media path resolution (path traversal); draft cache path manipulation blocked by deriving template style identity from verified database records; Live Preview and Coming Soon bypass restricted to authenticated users holding template edit rights; object-level authorization and ownership checks before frontend article attributes are saved; edit permission and item validation on Mega Menu configuration; sanitisation of Mega Menu modal JSON layout settings against XSS; strict heading tag, CSS colour format and attribute validation in the Page Title feature; hardened social sharing URL generation and JavaScript handlers; strict identifier validation and output encoding on video and audio embeds; escaped image source URLs in legacy image layout overrides. The Joomla CNA published five CVEs for this release on 31 August 2026, every one of them with the affected range 1.0-2.2.9: CVE-2026-78078 (8.9 High, privileged file upload bypass via content spoofing - upload validation checked only the file extension and basic size, so a non-image disguised with a raster extension was accepted; 2.2.10 adds strict MIME verification and GD binary raster decoding that fails closed), CVE-2026-78077 (8.6 High, stored XSS in the Mega Menu layout container and embed inputs - unsanitised column and item configuration values held in the Mega Menu layout JSON were rendered without complete contextual escaping), CVE-2026-78079 (5.3 Medium, open redirect - the return redirect parameter accepted any Base64 string without checking the resolved target with Uri::isInternal), CVE-2026-78075 (5.1 Medium, broken object-level authorization in Blog::remove_image - the check validated the article id passed in the request but never confirmed that the supplied image path belonged to that article, letting an author delete arbitrary files under /images/; reported by Phil Taylor of mySites.guru) and CVE-2026-78076 (5.1 Medium, missing item-level and menu-level authorization on the save-megamenu-settings AJAX endpoint, so an authenticated user could rewrite layout parameters for arbitrary menu items). Four of the five score PR:H and need an authenticated, privileged account; only the open redirect (CVE-2026-78079) is PR:N, and that one also needs user interaction. So the original judgement stands: this is not an unauthenticated remote attack surface, unlike CVE-2026-57829 / CVE-2026-57830 below. One trap when reading the CNA records: CVE-2026-78079 is TITLED 'Privileged File Upload Bypass via Content Spoofing', a straight duplicate of CVE-2026-78078's title, while its description and its CVSS vector are the open redirect. The description is the correct half. This is the same component and the same Mega Menu surface as CVE-2026-57829 and CVE-2026-57830, which were exploited in the wild in July 2026, so treat it as urgent. Action: update Helix Ultimate to 2.2.10 or later. Note this rule covers the plugin (System - Helix Ultimate Framework); the shaper_helixultimate TEMPLATE is a separate install that does not appear in Joomla Updates and must be upgraded manually. Joomla 3 sites cannot install 2.2.10 - JoomShaper ships a separate J3 security patch (helixultimate_j3_security_fixes, currently v1.0.3, released 31 August 2026) which leaves the reported extension version at 2.1.4-j3sec, so a J3 install gives no version evidence of its patch level and is deliberately outside this range.

All Video Share (com_allvideoshare) below 4.5.0 - Unauthenticated Reflected Cross-Site Scripting

Fri, 28 Aug 2026 00:00:00 GMT

All Video Share fails to escape a number of user supplied inputs, giving reflected cross-site scripting vectors that need no authentication (CVSS 4.0 vector PR:N, UI:P - the victim must follow a crafted link). Reported by Krzysztof Zajac of CERT PL. NOTE ON THE AFFECTED RANGE: the CVE record contradicts itself. Its structured affected-version field states 1.0.0 to 4.4.99, meaning the flaw is fixed in 4.5.0, while its own title and description both state the range as 1.0.0 to 4.5.0, which would make 4.5.0 affected as well. This rule follows the structured field, so 4.5.0 is treated as fixed. The record also names the vendor inconsistently, as j2commerce.com in the title and mrvinoth.com in the affected block; every installation seen on the platform is Vinoth Kumar / MrVinoth. The CVE gives one continuous affected range from 1.0.0 and no backport to the older 2.x or 3.x lines has been published, so sites still on those lines have no fixed release on their own branch and must move to 4.5.0 or later.

Sexy Polling Reloaded (com_sexypolling) 5.1.0 to 5.6.0 (Joomla 4 to 6) - Unauthenticated Blind SQL Injection

Fri, 28 Aug 2026 00:00:00 GMT

Sexy Polling Reloaded contains a blind SQL injection that needs no login, no token and no user interaction (CVSS 4.0 vector PR:N, base score 8.7 High), allowing an anonymous visitor to read arbitrary data from the site database. Reported by Krzysztof Zajac of CERT PL. The vendor, Jefferson49, maintains two parallel release lines and shipped the fix to both on 2026-07-25: 5.0.6.1 for the Joomla 3.10 and 4 line, and 5.6.1 for the Joomla 4, 5 and 6 line. Because 5.0.6.1 sorts below 5.6.1, a single rule written to the CVE ceiling of 5.6.1 would wrongly flag the patched legacy build, so this advisory is split into one rule per branch.

Sexy Polling Reloaded (com_sexypolling) below 5.0.6.1 (Joomla 3.10 and 4) - Unauthenticated Blind SQL Injection

Fri, 28 Aug 2026 00:00:00 GMT

DPCalendar (com_dpcalendar) 9.0.0 to 10.12.0 (Joomla 4 to 6) - Authenticated Stored Cross-Site Scripting

Fri, 28 Aug 2026 00:00:00 GMT

DPCalendar renders a calendar location title into a data-title HTML attribute without escaping it, giving a stored cross-site scripting flaw. A payload such as x" onmouseover="alert(1) has no HTML tags, so it passes through the filterText input filter unchanged and breaks out of the attribute on output, where it becomes a live event handler. Storing the payload requires an account with DPCalendar location create permission (CVSS 4.0 vector PR:H), but the script then runs in the browser of every visitor who views that location page, so the permission bounds who can plant it and not who it hits. This was reported in two stages. Toan Le found the original as vendor issue 12203, fixed on 2026-08-27 in 8.19.5 and 10.12.0, which escaped nine of the ten data-title sinks in the component. mySites.guru proved the same day that the tenth was still open, at components/com_dpcalendar/site/tmpl/location/default_map.php line 23, reported it to Digital Peak and the Joomla Security Strike Team, and Digital Peak confirmed it on 2026-08-28. That last sink was closed on 2026-09-10 in 8.19.6 and 10.12.1, along with seven identical sinks in the free mod_dpcalendar_upcoming module templates (blog, default, horizontal, icon, panel, simple and timeline). CVE-2026-78071 was updated on 2026-09-10 to widen its affected range to 7.0.0-8.19.5 and 9.0.0-10.12.0 and to credit both finders. Update to 10.12.1 on Joomla 4, 5 and 6. The 9.x line has no patch of its own, so sites there need the staged upgrade across to 10.12.1 rather than a point update. If you have overridden the DPCalendar location templates, the unescaped output is still in your override and updating the extension will not reach it.

DPCalendar (com_dpcalendar) 7.0.0 to 8.19.5 (Joomla 3) - Authenticated Stored Cross-Site Scripting

Fri, 28 Aug 2026 00:00:00 GMT

DPCalendar renders a calendar location title into a data-title HTML attribute without escaping it, giving a stored cross-site scripting flaw. A payload such as x" onmouseover="alert(1) has no HTML tags, so it passes through the filterText input filter unchanged and breaks out of the attribute on output, where it becomes a live event handler. Storing the payload requires an account with DPCalendar location create permission (CVSS 4.0 vector PR:H), but the script then runs in the browser of every visitor who views that location page, so the permission bounds who can plant it and not who it hits. This was reported in two stages. Toan Le found the original as vendor issue 12203, fixed on 2026-08-27 in 8.19.5 and 10.12.0, which escaped nine of the ten data-title sinks in the component. mySites.guru proved the same day that the tenth was still open, at components/com_dpcalendar/site/tmpl/location/default_map.php line 23, reported it to Digital Peak and the Joomla Security Strike Team, and Digital Peak confirmed it on 2026-08-28. That last sink was closed on 2026-09-10 in 8.19.6 and 10.12.1, along with seven identical sinks in the free mod_dpcalendar_upcoming module templates (blog, default, horizontal, icon, panel, simple and timeline). CVE-2026-78071 was updated on 2026-09-10 to widen its affected range to 7.0.0-8.19.5 and 9.0.0-10.12.0 and to credit both finders. On Joomla 3 the fixed version is 8.19.6, which is a security-only release containing this one change. If you have overridden the DPCalendar location templates, the unescaped output is still in your override and updating the extension will not reach it.

DPCalendar (com_dpcalendar) 9.0.0 to 10.11.2 (Joomla 4 to 6) - Authenticated Blind SQL Injection

Fri, 28 Aug 2026 00:00:00 GMT

DPCalendar contains a blind SQL injection reachable by saving a Joomla article. The DPCalendar content plugin passes the order and orderdir parameters of a {dpcalendar} tag into the events query ORDER BY clause without validating them against the model filter_fields allow-list. The sink used the database escape() helper, which secures string literals but not SQL identifiers, so the sort column is injectable. Exploitation requires an account holding permission to create or update articles, so this is authenticated and privileged (CVSS 4.0 vector PR:H), not anonymous. Reported by Toan Le as vendor issue 12206. Fixed in 10.12.0 on the Joomla 4 to 6 branch and backported to 8.19.5 on the Joomla 3 branch. Temporary mitigation: disable the "Content - DPCalendar" plugin, which is the only route in.

DPCalendar (com_dpcalendar) 5.5.0 to 8.19.4 (Joomla 3) - Authenticated Blind SQL Injection

Fri, 28 Aug 2026 00:00:00 GMT

T4 Page Builder (com_t4pagebuilder) below 2.3.0 - Unauthenticated Mail Relay and AcyMailing Table Writes, Missing CSRF Token

Fri, 28 Aug 2026 00:00:00 GMT

JoomlArt released T4 Page Builder 2.3.0 on 28 August 2026, fixing an unauthenticated open mail relay that mySites.guru reported to the vendor and to the Joomla Security Strike Team on 17 August 2026, after finding it in use on a client site. In versions below 2.3.0 the front-end contact action is exempt from the component's ACL checks and accepts a recipient address supplied in the request, so any anonymous visitor can send mail to arbitrary addresses using the site's configured sender identity: the site becomes an open mail relay for spam and phishing sent under its own domain, SPF and DKIM. The same endpoint requires no Joomla form token (CSRF), applies no rate limiting, and relies on whether a captcha plugin is enabled rather than validating a captcha response. The subscribe task on the same endpoint allows unauthenticated writes to connected AcyMailing subscription tables. The component also ships a live Mailchimp API key hardcoded into its source, which should be rotated by its owner. mySites.guru verified the fix by auditing the released 2.3.0 package on 3 September 2026: the contact action now requires a valid form token, rate limits per IP (5 requests per 10 minutes by default), validates captcha explicitly, and delivers only to administrator addresses via getAdminMails() rather than the request-supplied recipient. The hardcoded key is absent from the 2.3.0 package and the Mailchimp credentials are read from component parameters. Update to T4 Page Builder 2.3.0 or later from the JoomlArt member area, clear the Joomla cache, then re-test all contact and subscription forms. Temporary mitigation: unpublish public contact and subscription forms built with T4 Page Builder until the update is applied. CVE-2026-78374 was assigned by the Joomla CNA on 10 September 2026, at the reporter's request rather than the vendor's. The record is reserved and not yet published at MITRE or NVD, and JoomlArt still credits no reporter. The vendor states no affected floor, so every version below 2.3.0 is treated as affected.

JEM - Joomla Event Manager (com_jem) below 5.0.1 - Privileged Remote Code Execution, Unauthenticated Article Overwrite and Force-Publish, Cross-User Event and Venue Takeover, Reflected XSS and Attendee Data Disclosure

Thu, 27 Aug 2026 00:00:00 GMT

JEM (Joomla Event Manager) by the JEM Community is affected by multiple vulnerabilities confirmed live against JEM 5. The Joomla Security Strike Team assigned five CVE IDs on 22 August 2026 and published all five records on 27 August 2026: CVE-2026-77991, CVE-2026-77034, CVE-2026-77035, CVE-2026-77989 and CVE-2026-77990. Every record gives the affected range as 1.0.0 to 5.0.0. There is still no stable version to update to. The fixes exist only in a public 5.0.1 release candidate (the 5.0.1-bugfixes branch on GitHub). The newest stable release remains 5.0.0-stable, from 8 July 2026, which is affected. Confirmed issues: (1) Privileged remote code execution (CVE-2026-77991, CVSS 9.4 Critical) - the administrator source model writes dangerous file types including PHP, giving code execution to an account that already holds administrator access. (2) Unauthenticated article overwrite and force-publish (CVE-2026-77034, CVSS 6.9) - the front-end event.updateAssociatedArticle task performs no ACL check before writing a Joomla content article, so any visitor holding their own session token can republish and overwrite an article associated with an event, including publishing an unpublished one. (3) Cross-user event and venue takeover (CVE-2026-77035, CVSS 5.1) - allowEdit() trusts jform[created_by] and jform[access] from POST data, so a registered user with edit-own rights (the eventowner=1 setting or core.edit.own) can POST another user's record id together with their own id as created_by and take over that record. (4) Reflected XSS via the PDF export link (CVE-2026-77989, CVSS 5.3) - buildCurrentPdfLink copies the current request query string into the PDF button URL and pdfbutton() echoes it unescaped (attribute injection, no tags required). (5) Attendee data disclosure (CVE-2026-77990, CVSS 5.3) - any logged-in non-manager can read attendee names, usernames, registration dates and statuses for events they do not manage, including lists belonging to unpublished events. One further item found by code reading, stored XSS through unescaped category names, has no CVE. Mitigation until 5.0.1 stable ships: restrict front-end event and venue editing and the front-end attendees view to trusted users only, consider disabling front-end event submission, and review who holds administrator access on the site given the source-model file write. Update to JEM 5.0.1 or later as soon as a stable release is available. This rule flags every JEM version below 5.0.1, which matches the affected range stated in all five CVE records.

miniOrange SAML SSO (com_miniorange_saml) - Unauthenticated Authentication Bypass (CVSS 10.0)

Tue, 25 Aug 2026 00:00:00 GMT

miniOrange SAML SSO for Joomla is affected by an unauthenticated authentication bypass, CVE-2026-77998, scored CVSS 4.0 10.0 (critical). UtilitiesSAML::validateSignature() performs a loose boolean check on the tri-state integer returned by PHP openssl_verify(), so the error return value of -1 is treated as truthy and therefore as a successful signature verification. An unauthenticated attacker can submit a crafted SAMLResponse holding an attacker-controlled NameID together with a deliberately malformed signature value that triggers an OpenSSL processing error, bypassing verification entirely and logging in as any existing user, administrators included. FIXED VERSIONS: miniOrange ships this extension as several separately numbered editions, and the leading digit identifies the EDITION rather than the age, so a higher version number is not necessarily newer. Free edition is fixed in 11.0.2 (and 6.4 for the ADFS and Google Apps editions). The paid SAML SP editions were announced to miniOrange customers on 26 August 2026 and confirmed publicly the same day by David Jardin of the Joomla Security Strike Team: Basic is affected up to 13.1 and fixed in 13.2; Standard is affected up to 24.1 and fixed in 24.2; Premium is affected up to 34.1 and fixed in 34.2; Enterprise is affected up to 44.1 and fixed in 44.2. UPDATE PATH WARNING: miniOrange state that 13.0, 13.1, 24.0, 24.1, 34.0, 34.1, 44.0 and 44.1 can install the fixed release directly over the top, but anything below 13.0, 24.0, 34.0 or 44.0 must be uninstalled first and then reinstalled. On a site where SAML is the only login method, uninstalling the plugin locks every user out, administrators included, so confirm you have a working local Joomla Super User account and a current backup before you start. If the plugin was customised for you, save its configuration and tell miniOrange before replacing it. NOTE ON THE CVE RECORD: as at 26 August 2026 the published CVE record still gives its affected range as 1.0.0 to 11.0.1, which describes the free edition only, and it has not been re-scoped to cover the paid editions. This rule set deliberately goes beyond the range stated in the CVE, on the strength of the vendor written statement of the paid fix versions. If you cannot update immediately, disable or remove the extension rather than leaving an anonymous administrator login available.

miniOrange SAML SSO (com_miniorange_saml) - Unauthenticated Authentication Bypass (CVSS 10.0)

Tue, 25 Aug 2026 00:00:00 GMT

miniOrange SAML SSO (com_miniorange_saml) - Unauthenticated Authentication Bypass (CVSS 10.0)

Tue, 25 Aug 2026 00:00:00 GMT

miniOrange SAML SSO (com_miniorange_saml) - Unauthenticated Authentication Bypass (CVSS 10.0)

Tue, 25 Aug 2026 00:00:00 GMT

YOOtheme Pro (location) below 4.5.34 - Authenticated Stored Cross-Site Scripting via Unescaped Custom Field Value (CVSS 7.5)

Tue, 25 Aug 2026 00:00:00 GMT

The YOOtheme Location custom field plugin below 4.5.34, the Joomla 3 branch, writes the stored field value into a hidden input without escaping it, so a user who can set that field value can store JavaScript that then runs for anyone who later edits the item (CVE-2026-77996, CVSS 7.5). Fixed in 4.5.34 by escaping the value with htmlspecialchars(); update to 4.5.35, the current build on that branch. The Joomla 4/5/6 branch fixes the same flaw in 5.0.42. The version floor on this rule is deliberate: at least two unrelated vendors, Michael Richey and DigitAll Tools, also ship a plugin with folder "fields" and element "location", and their releases sit below 2.0.0 or above 5.0.0.

YOOtheme Pro (yootheme) below 4.5.34 - Authenticated SQL Injection (CVSS 8.6), Arbitrary File Read (CVSS 7.0) and Broken Access Control (CVSS 5.1)

Tue, 25 Aug 2026 00:00:00 GMT

YOOtheme Pro below 4.5.34, the Joomla 3 branch, has three flaws reachable by an authenticated user who can edit templates. CVE-2026-76613 (CVSS 8.6) is an SQL injection in the page builder's article and tag source ORDER BY handling. CVE-2026-75115 (CVSS 7.0) is an arbitrary file read via a glob-pattern escape in the Filesystem source path filter. CVE-2026-77997 (CVSS 5.1) is a missing authorisation check in the module controller that returns any module's configuration to a user who holds only com_templates edit rights. All three are fixed in 4.5.34, released 24 August 2026. Update to 4.5.35, released 25 August 2026, which adds a regression fix for custom-field ordering in the Articles model. Sites on 1.x, 2.x, 3.x or 4.0 to 4.4 have no fixed release on their own line: the fix is to move to 4.5.35, or to migrate to the 5.0.x branch on Joomla 4/5/6. All three CVEs are scored PR:H, so an attacker needs an existing privileged account rather than anonymous access.

YOOtheme Pro (yootheme) below 4.5.34 - Authenticated SQL Injection (CVSS 8.6), Arbitrary File Read (CVSS 7.0) and Broken Access Control (CVSS 5.1)

Tue, 25 Aug 2026 00:00:00 GMT

miniOrange SAML SSO (com_miniorange_saml) - Unauthenticated Authentication Bypass (CVSS 10.0)

Tue, 25 Aug 2026 00:00:00 GMT

YOOtheme Pro (location) 5.0.41 - Authenticated Stored Cross-Site Scripting via Unescaped Custom Field Value (CVSS 7.5)

Tue, 25 Aug 2026 00:00:00 GMT

YOOtheme Pro 5.0.41's Location custom field (plg_fields_location) rendered its stored value straight into a hidden input's HTML attribute with no escaping, because LocationField::getInput() built that markup by plain string interpolation. A stored attribute-breakout payload therefore fires when the item's edit form is next opened by anyone, up to and including a Super User. Published as CVE-2026-77996 by the Joomla CNA on 25 August 2026, CVSS 4.0 base 7.5 High (AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N). The affected range on the record is 1.0.0 to 5.0.41. The CNA classes this as authenticated and privileged: storing the payload needs rights to edit an item that carries the field, and it only fires when someone later opens that item's edit form. As a Joomla custom field it can attach to articles, contacts, categories or users, so the practical exposure on any given site depends on which of those the field is attached to and who can edit them. Fixed in 5.0.42, which wraps the value in htmlspecialchars(..., ENT_QUOTES, 'UTF-8'). Confirmed by diffing the 5.0.41 and 5.0.42 packages. Note: this extension's technical identity (type=plugin, folder=fields, element=location) collides with two unrelated third-party extensions also named "Fields - Location", from developers Michael Richey and DigitAll Tools. Re-checked against live install data on 25 August 2026: they top out at 5.0.5 and 1.0 respectively, both below this rule's 5.0.41 floor, so neither is caught. Any future widening of this rule's floor must re-check that install base first. Update YOOtheme Pro to 5.0.42 or later through the Joomla Extensions manager, or download it from your YOOtheme account.

YOOtheme Pro (yootheme) 5.0.41 - Authenticated Broken Access Control in Module Controller (Information Disclosure, CVSS 5.1)

Tue, 25 Aug 2026 00:00:00 GMT

YOOtheme Pro 5.0.41's Page Builder module controller (ModuleController::getModule()) had no permission check of its own, unlike its sibling save endpoint which already required core.edit on com_modules.module.{id}. Reaching it via GET /index.php?option=com_ajax&p=/module&id= returned that module's title, full params JSON (which can include API keys, raw HTML or JS, and other sensitive module configuration) and rendered content, for any module id on the site, published or unpublished. Published as CVE-2026-77997 by the Joomla CNA on 25 August 2026, CVSS 4.0 base 5.1 Medium (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N). The affected range on the record is 1.0.0 to 5.0.41. Exploitation requires an authenticated user who already holds core.edit on com_templates. YOOtheme's CheckUserPermission middleware runs on every route the framework dispatches and aborts with 403 (or redirects a guest to the login page) unless that permission is held, and the /module route does not opt out of it as the newsletter and image routes do. This is therefore a privilege boundary crossed sideways rather than an anonymous read: a user trusted to edit templates could read the configuration of any module on the site without holding any com_modules permission at all. Fixed in 5.0.42, which adds an explicit $user->authorise('core.edit', 'com_modules.module.{id}') check to getModule(). Confirmed by diffing the 5.0.41 and 5.0.42 packages and tracing the full request path. Note that YOOtheme Pro installs as both a template and a system plugin, and both report the element yootheme, so a single site normally shows two rows for this. Updating YOOtheme Pro updates both together. Update YOOtheme Pro to 5.0.42 or later through the Joomla Extensions manager, or download it from your YOOtheme account.

YOOtheme Pro (yootheme) 5.0.41 - Authenticated Broken Access Control in Module Controller (Information Disclosure, CVSS 5.1)

Tue, 25 Aug 2026 00:00:00 GMT

miniOrange OAuth Client (com_miniorange_oauth) 1.0.0 to 3.1.9 - Unauthenticated Account Takeover (CVSS 10.0)

Mon, 24 Aug 2026 00:00:00 GMT

miniOrange OAuth Client versions 1.0.0 to 3.1.9 are affected by an unauthenticated account takeover, CVE-2026-77995, scored CVSS 4.0 10.0 (critical). Manipulation of a cookie value allows an attacker with no login to authenticate as an arbitrary account, Super Users included. Update the miniOrange OAuth Client to 3.2.0 or later. IMPORTANT edition caveat: miniOrange ships several separately numbered OIDC editions under this same com_miniorange_oauth element, including Login with Azure AD, Login with Keycloak OAuth Single Sign-On and Single Sign-On for Educational Institutes. miniOrange confirmed in writing on 26 August 2026 that those three are fixed in 1.2.2, not 3.2.0, and that all of the fixed versions they gave apply to the free editions only. Check the display name of the installed extension before acting on a version number, and if the site reports a two-segment version such as 32.0.1 or 34.0.0 it is a paid edition. miniOrange stated in writing on 4 September 2026 that CVE-2026-77995 was associated only with the free OAuth Client and that their investigation found the flaw in no version of the paid OAuth editions, which is why no paid security build was ever released. This rule's ceiling of 3.1.9 therefore excludes every paid build on purpose, and no paid install has ever been flagged by it. Note that this rests on the vendor's assessment: the CVE record still names a single product with no edition qualifier, and the same vendor scoped the SAML record to the free line before it had to be widened to name all four paid editions.

Fabrik (com_fabrik) 4.7.0 and 4.7.1 - Unauthenticated Remote Code Execution risk, update to 4.7.2

Sat, 22 Aug 2026 00:00:00 GMT

Fabrik (the Joomla form and list builder by Fabrikar) shipped a series of security releases across the 4.7.x line. 4.7.2 is the release mySites.guru has verified, and 4.7.0 and 4.7.1 are missing part of that work. The calc element in this component carried a published unauthenticated remote code execution vulnerability (CVE-2026-66915 and CVE-2026-67282, both CVSS 10.0). mySites.guru worked with Fabrikar through the 4.7.x releases under coordinated disclosure, and 4.7.2 closes the issues raised. What to do: update Fabrik to 4.7.2, downloaded from fabrikar.com. Until you have, restrict front-end access to Fabrik forms and lists to trusted users. Sites below 4.7.0 are covered by a separate rule and remain exposed to the published CVSS 10.0 RCE.

JoomGallery (com_joomgallery) 4.0.0 to 4.3.x - Authenticated Access to Password-Protected Content, Ownership Takeover and Stored XSS (CVE-2026-66916, CVE-2026-66917)

Sat, 22 Aug 2026 00:00:00 GMT

Every JoomGallery 4.x release from 4.0.0 up to and including the 4.3.x line carries two security flaws, present since the start of the 4.x branch. Both were reported to the vendor on 3 August 2026 by Toan Le and fixed in 4.4.0. CVE-2026-66916 (unauthorised access to protected content): information about images and categories can be read even when that content is meant to be protected. This mainly affects password-protected galleries, where details may be disclosed and, in some cases, the protected images themselves accessed or downloaded without authorisation. CVE-2026-66917 (ownership manipulation and JavaScript injection): a logged-in user holding edit permissions can reassign ownership of images or categories belonging to other users, which then grants them rights over content they never owned. The same flaw allows JavaScript to be injected through certain front-end views, so the injected code executes in the browser of anyone who later views that content (stored XSS). Exploitation requires a logged-in user with the relevant JoomGallery editing permissions, so the exposure is highest on galleries that let members edit content from the front end. The vendor rates both as medium risk and states that full system compromise is not possible. A gallery managed only by trusted administrators in the back end, with no front-end editing granted to other users, is at significantly lower practical risk. Fix: update to JoomGallery 4.4.0 or later, then review the editable content for anything already tampered with. If you use JoomGallery template overrides, apply the changes from the update to those overrides as well, otherwise an override can reintroduce the vulnerable output. Temporary mitigation until you can update: withdraw front-end JoomGallery edit permissions from all non-administrator user groups via the component ACL. This rule covers the Joomla 4/5/6 branch only. The separate JoomGallery 3.x branch for Joomla 3 is not covered by this advisory.

J2Store / J2Commerce (com_j2store) 4.1.0 to 4.1.5 - Unauthenticated File Upload (exploited in the wild), Order Data Disclosure, Stored XSS and IDOR (6 CVEs)

Fri, 21 Aug 2026 00:00:00 GMT

J2Store / J2Commerce 4.1.x before 4.1.6 is affected by six vulnerabilities in com_j2store, disclosed and fixed by J2Commerce on 20 August 2026. CVE-2026-67361 (CVSS 6.9): the cart file-upload endpoint (view=carts, task=upload) accepted POST requests from unauthenticated visitors with no CSRF token, and the installer manifest omitted media/j2store/uploads/ and media/j2store/invoices/ from its media section, so fresh installs created those folders without their .htaccess and web.config protection and uploaded files were directly reachable by URL. The vendor confirms this was EXPLOITED IN THE WILD before the fix shipped. Joomla's MediaHelper::canUpload() blocked .php, so remote code execution was not achieved, but arbitrary images, PDFs, CSVs and documents could be written and then retrieved publicly. CVE-2026-67359 (CVSS 8.7): an unauthenticated visitor could pass any order_id to view=checkout, task=expressconfirm and render another customer's full express-checkout confirmation page, including line items, quantities, prices and totals. CVE-2026-74252 (CVSS 8.6): unauthenticated stored XSS through the guest checkout billing address fields, via a filter bypass in Joomla's Input::getArray() combined with PHP variables_order=EGPCS letting a cookie override POST in $_REQUEST; the payload fires in the administrator order management panel. CVE-2026-67360 (CVSS 6.3): an authenticated user who obtained another customer's order_id could call view=myprofile, task=reOrder and copy that customer's cart contents, product options and billing/shipping address IDs into their own session; the CSRF token was checked but ownership was not. CVE-2026-67358 (CVSS 5.3): a user holding a valid order token could increment the download limit counter on a download record belonging to a different order, and the endpoint had no CSRF token. CVE-2026-67362 (CVSS 5.1): four cart task handlers (setcurrency, addItem, applyCoupon, applyVoucher) decoded a base64 URL supplied by the user and redirected to it with no host validation, enabling phishing from the shop's own trusted domain, unauthenticated. FIX: update to 4.1.6 on this 4.1.x branch (the equivalent fixes are 3.3.21 on the Joomla 3 branch and 4.0.21 on 4.0.x). J2Commerce 6 is a separate rewritten codebase and is not affected. Because the upload flaw was exploited in the wild, also review media/j2store/uploads/ and the older media/com_j2store/uploads/ for files you do not recognise: the 4.1.6 installer scans and lists them but deliberately deletes nothing. UPDATE, 31 August 2026: a further five vulnerabilities (CVE-2026-77999, CVE-2026-78000, CVE-2026-78064, CVE-2026-78065 and CVE-2026-78069, up to CVSS 9.4 Critical) affect every build below 4.1.7, so 4.1.6 is no longer a sufficient fix. Update to 4.1.7.

J2Store / J2Commerce (com_j2store) 4.0.0 to 4.0.20 - Unauthenticated File Upload (exploited in the wild), Order Data Disclosure, Stored XSS and IDOR (6 CVEs)

Fri, 21 Aug 2026 00:00:00 GMT

J2Store / J2Commerce 4.0.x before 4.0.21 is affected by six vulnerabilities in com_j2store, disclosed and fixed by J2Commerce on 20 August 2026. CVE-2026-67361 (CVSS 6.9): the cart file-upload endpoint (view=carts, task=upload) accepted POST requests from unauthenticated visitors with no CSRF token, and the installer manifest omitted media/j2store/uploads/ and media/j2store/invoices/ from its media section, so fresh installs created those folders without their .htaccess and web.config protection and uploaded files were directly reachable by URL. The vendor confirms this was EXPLOITED IN THE WILD before the fix shipped. Joomla's MediaHelper::canUpload() blocked .php, so remote code execution was not achieved, but arbitrary images, PDFs, CSVs and documents could be written and then retrieved publicly. CVE-2026-67359 (CVSS 8.7): an unauthenticated visitor could pass any order_id to view=checkout, task=expressconfirm and render another customer's full express-checkout confirmation page, including line items, quantities, prices and totals. CVE-2026-74252 (CVSS 8.6): unauthenticated stored XSS through the guest checkout billing address fields, via a filter bypass in Joomla's Input::getArray() combined with PHP variables_order=EGPCS letting a cookie override POST in $_REQUEST; the payload fires in the administrator order management panel. CVE-2026-67360 (CVSS 6.3): an authenticated user who obtained another customer's order_id could call view=myprofile, task=reOrder and copy that customer's cart contents, product options and billing/shipping address IDs into their own session; the CSRF token was checked but ownership was not. CVE-2026-67358 (CVSS 5.3): a user holding a valid order token could increment the download limit counter on a download record belonging to a different order, and the endpoint had no CSRF token. CVE-2026-67362 (CVSS 5.1): four cart task handlers (setcurrency, addItem, applyCoupon, applyVoucher) decoded a base64 URL supplied by the user and redirected to it with no host validation, enabling phishing from the shop's own trusted domain, unauthenticated. FIX: update to 4.0.21 on this 4.0.x branch (the equivalent fixes are 3.3.21 on the Joomla 3 branch and 4.1.6 on 4.1.x). J2Commerce 6 is a separate rewritten codebase and is not affected. Because the upload flaw was exploited in the wild, also review media/j2store/uploads/ and the older media/com_j2store/uploads/ for files you do not recognise: the 4.0.21 installer scans and lists them but deliberately deletes nothing. UPDATE, 31 August 2026: a further five vulnerabilities (CVE-2026-77999, CVE-2026-78000, CVE-2026-78064, CVE-2026-78065 and CVE-2026-78069, up to CVSS 9.4 Critical) affect every build below 4.0.22, so 4.0.21 is no longer a sufficient fix. Update to 4.0.22.

J2Store / J2Commerce (com_j2store) below 3.3.21 (Joomla 3 branch) - Unauthenticated File Upload (exploited in the wild), Order Data Disclosure, Stored XSS and IDOR (6 CVEs)

Fri, 21 Aug 2026 00:00:00 GMT

J2Store on the Joomla 3 branch before 3.3.21 is affected by six vulnerabilities in com_j2store, disclosed and fixed by J2Commerce on 20 August 2026. CVE-2026-67361 (CVSS 6.9): the cart file-upload endpoint (view=carts, task=upload) accepted POST requests from unauthenticated visitors with no CSRF token, and the installer manifest omitted media/j2store/uploads/ and media/j2store/invoices/ from its media section, so fresh installs created those folders without their .htaccess and web.config protection and uploaded files were directly reachable by URL. The vendor confirms this was EXPLOITED IN THE WILD before the fix shipped. Joomla's MediaHelper::canUpload() blocked .php, so remote code execution was not achieved, but arbitrary images, PDFs, CSVs and documents could be written and then retrieved publicly. CVE-2026-67359 (CVSS 8.7): an unauthenticated visitor could pass any order_id to view=checkout, task=expressconfirm and render another customer's full express-checkout confirmation page, including line items, quantities, prices and totals. CVE-2026-74252 (CVSS 8.6): unauthenticated stored XSS through the guest checkout billing address fields, via a filter bypass in Joomla's Input::getArray() combined with PHP variables_order=EGPCS letting a cookie override POST in $_REQUEST; the payload fires in the administrator order management panel. CVE-2026-67360 (CVSS 6.3): an authenticated user who obtained another customer's order_id could call view=myprofile, task=reOrder and copy that customer's cart contents, product options and billing/shipping address IDs into their own session; the CSRF token was checked but ownership was not. CVE-2026-67358 (CVSS 5.3): a user holding a valid order token could increment the download limit counter on a download record belonging to a different order, and the endpoint had no CSRF token. CVE-2026-67362 (CVSS 5.1): four cart task handlers (setcurrency, addItem, applyCoupon, applyVoucher) decoded a base64 URL supplied by the user and redirected to it with no host validation, enabling phishing from the shop's own trusted domain, unauthenticated. FIX: update to 3.3.21 on this Joomla 3 branch (the equivalent fixes are 4.0.21 on 4.0.x and 4.1.6 on 4.1.x). J2Commerce 6 is a separate rewritten codebase and is not affected. Because the upload flaw was exploited in the wild, also review media/j2store/uploads/ and the older media/com_j2store/uploads/ for files you do not recognise: the 3.3.21 installer scans and lists them but deliberately deletes nothing. Versions below 3.3.13 are additionally affected by CVE-2020-13996, an authenticated Store Manager SQL injection; updating to 3.3.21 resolves that as well. UPDATE, 31 August 2026: a further five vulnerabilities (CVE-2026-77999, CVE-2026-78000, CVE-2026-78064, CVE-2026-78065 and CVE-2026-78069, up to CVSS 9.4 Critical) affect every build below 3.3.22, so 3.3.21 is no longer a sufficient fix. Update to 3.3.22.