Vulnérabilités
Joomla CMS et extensions — une fiche par CVE, toutes sources fusionnées.
CVE-2026-67282
Unauthenticated remote code execution in Fabrik < 4.6.8
CRITICAL
CVSS 10.0
CVE-2026-66915
Remote code execution in Fabrik < 4.7.2
CRITICAL
CVSS 10.0
CVE-2026-66914
Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1
CRITICAL
CVSS 9.2
CVE-2026-66494
Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0
HIGH
CVSS 8.7
CVE-2026-66493
Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3
MEDIUM
CVSS 6.4
CVE-2026-66492
Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3
MEDIUM
CVSS 6.1
CVE-2026-66491
Arbitrary File Read in Phoca Commander 1.0.0-6.1.3
HIGH
CVSS 8.2
CVE-2026-65947
Various CSRF vectors in the admin interface in Gridbox < 2.20.2
HIGH
CVSS 7.3
CVE-2026-65888
Account takeover vulnerability in Gridbox < 2.20.2
CRITICAL
CVSS 10.0
CVE-2026-65887
Unauthenticated arbitrary password reset in Gridbox < 2.20.2
CRITICAL
CVSS 10.0
CVE-2026-65886
Unauthenticated arbitrary file read in Gridbox < 2.20.2
CRITICAL
CVSS 9.2
CVE-2026-66490
Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2
MEDIUM
CVSS 6.1
CVE-2026-66489
Various unauthenticated file system disclosure in Gridbox < 2.20.2
MEDIUM
CVSS 5.3
CVE-2026-66488
Payment bypass in Gridbox < 2.20.2
MEDIUM
CVSS 5.3
CVE-2026-65890
Unauthenticated SQL injection in Gridbox < 2.20.2
CRITICAL
CVSS 9.2
CVE-2026-65889
Unauthenticated recursive directory deletion < 2.20.2
CRITICAL
CVSS 9.2
CVE-2026-65946
XSS vectors in AJAX endpoint handlers RO CSVI < 9.11.0
MEDIUM
CVSS 6.1
CVE-2026-65944
CSRF vectors in AJAX endpoint handlers RO CSVI < 9.11.0
HIGH
CVSS 8.8
CVE-2026-65943
Unauthenticated directory creation RO CSVI < 9.11.0
HIGH
CVSS 7.5
CVE-2026-65891
Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) < 2.20.2
MEDIUM
CVSS 6.5