CVE-2026-64796

various code injection vectors in Sourcerer extension

CRITICAL Extension Joomla — regularlabs.com Source officielle

Description

Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured include folder, and executable script/style variants could bypass detection.

Sévérité

9.8 Critique · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Score retenu : NVD

Source	Sévérité d'origine	CVSS
NVD	CRITICAL	9.8 (v3.1)

Produit et versions

Produit: Extension Joomla — regularlabs.com
Corrigée dans: Non précisée
Publiée: 22/07/2026
Modifiée: 27/07/2026
CWE: CWE-284

Versions concernées

Sourcerer extension for Joomla — 1.0.0 – 12.2.8

Sources

NVD CNA Joomla CVE-2026-64796 vu il y a 2 h

Ces informations proviennent des sources ci-dessus ; CVE Oyer n'y ajoute aucune interprétation.

Historique

Détectée via nvd26/09/2026 09:34 UTC

RéférencesJSON

regularlabs.comNVD