Vulnérabilités
Joomla CMS et extensions — une fiche par CVE, toutes sources fusionnées.
CVE-2026-65766
Unauthenticated SQL injection in SP Page Builder < 6.7.1
CRITICAL
CVSS 9.2
CVE-2026-65765
Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1
MEDIUM
CVSS 6.9
CVE-2026-65764
Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1
MEDIUM
CVSS 5.1
CVE-2026-65763
Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4
MEDIUM
CVSS 5.1
CVE-2026-65762
Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0
MEDIUM
CVSS 5.1
CVE-2026-65761
Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1
CRITICAL
CVSS 9.3
CVE-2026-65760
cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1
CRITICAL
CVSS 9.2
CVE-2026-65759
unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1
HIGH
CVSS 8.7
CVE-2026-65758
Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2
HIGH
CVSS 8.2
CVE-2026-65757
Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension
HIGH
CVSS 8.1
CVE-2026-65756
XSS vector in Keyboard Shortcuts extension
MEDIUM
CVSS 6.1
CVE-2026-65755
Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension
HIGH
CVSS 7.5
CVE-2026-65754
Insecure path handling in ReReplacer Pro extension
HIGH
CVSS 7.5
CVE-2026-65713
Insecure path handling in Modals Pro extension
MEDIUM
CVSS 6.5
CVE-2026-65712
Insecure path handling in CDN for Joomla Pro extension
MEDIUM
CVSS 6.2
CVE-2026-65431
Zipslip in GeoIP extension
CRITICAL
CVSS 9.8
CVE-2026-65430
MaxMind Credential leakage in GeoIP extension
HIGH
CVSS 7.5
CVE-2026-64876
Inconsistent CSRF token checks / privilege checks in GeoIP extension
HIGH
CVSS 8.8
CVE-2026-64875
IP spoofing vulnerability in GeoIP extension
MEDIUM
CVSS 6.5
CVE-2026-64874
CDN Credential leakage Cache Cleaner Pro extension
CRITICAL
CVSS 9.8