Vulnérabilités
Joomla CMS et extensions — une fiche par CVE, toutes sources fusionnées.
CVE-2026-76569
Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4
MEDIUM
CVSS 5.3
CVE-2026-76565
Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7
MEDIUM
CVSS 5.3
CVE-2026-76564
Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7
HIGH
CVSS 8.6
CVE-2026-75948
Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12
HIGH
CVSS 8.6
CVE-2026-75956
DOS vector in pagination parameter handling in J-BusinessDirectory < 6.2.3
HIGH
CVSS 8.7
CVE-2026-75955
Reflected XSS / XML injection in J-BusinessDirectory < 6.2.3
MEDIUM
CVSS 5.1
CVE-2026-75954
SQL injection in trips search in J-BusinessDirectory < 6.2.3
CRITICAL
CVSS 9.3
CVE-2026-75953
Open mail relay in J-BusinessDirectory < 6.2.3
HIGH
CVSS 7.5
CVE-2026-75952
Cross-site request forgery in J-BusinessDirectory < 6.2.3
MEDIUM
CVSS 4.6
CVE-2026-75951
Insecure Direct Object Reference (multiple frontend/API actions) in J-BusinessDirectory < 6.2.3
MEDIUM
CVSS 6.9
CVE-2026-75950
Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3
MEDIUM
CVSS 6.9
CVE-2026-75949
Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3
CRITICAL
CVSS 10.0
CVE-2026-75114
Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64
MEDIUM
CVSS 5.1
CVE-2026-74804
Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64
CRITICAL
CVSS 9.3
CVE-2026-74803
Unauthenticated arbitrary file upload in Zoo < 4.1.64
CRITICAL
CVSS 10.0
CVE-2026-67364
Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2
CRITICAL
CVSS 10.0
CVE-2026-67363
Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2
HIGH
CVSS 7.7
CVE-2026-74254
SQL injection in Page Builder CK < 3.6.5
CRITICAL
CVSS 9.3
CVE-2026-74253
Unauthenticated RCE through unverified reflected user input in Sourcerer < 16.0.0
CRITICAL
CVSS 10.0
CVE-2026-73373
Unrestricted uploads of SHTML files
HIGH
CVSS 8.9