Vulnérabilités Joomla

CVE-2026-88857 Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 OrdaSoft Joomla Gallery free · 1 source · il y a 5 j CRITICAL CVSS 9.4

CVE-2026-88856 Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 OrdaSoft Joomla Gallery free · 1 source · il y a 5 j CRITICAL CVSS 9.4

CVE-2026-88854 Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 OrdaSoft Joomla Gallery free · 1 source · il y a 5 j CRITICAL CVSS 9.3

CVE-2026-85192 Authenticated, privileged remote code execution in Conditional Content extension for Joomla < 8.0.0 Conditional Content Pro · 1 source · il y a 12 j CRITICAL CVSS 9.4

CVE-2026-78082 Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4 Extension Joomla — joomshaper.com · 1 source · il y a 16 j CRITICAL CVSS 9.3

CVE-2026-78080 Unauthenticated SQL injection in JooDatabase Lite < 5.1.0 Extension Joomla — joodb.feenders.de · 1 source · il y a 22 j CRITICAL CVSS 9.3

CVE-2026-78069 Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 Extension Joomla — j2commerce.com · 1 source · il y a 22 j CRITICAL CVSS 9.5

CVE-2026-77991 Privileged remote code execution in Joomla Event Manager < 5.0.1 Extension Joomla — joomlaeventmanager.net · 1 source · il y a 30 j CRITICAL CVSS 9.4

CVE-2026-77998 Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4 Extension Joomla — miniorange.com · 1 source · il y a 31 j CRITICAL CVSS 10.0

CVE-2026-77995 Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2 Extension Joomla — miniorange.com · 1 source · il y a 32 j CRITICAL CVSS 10.0

CVE-2026-77994 Second order SQL injection in Page Builder CK < 3.6.5 Extension Joomla — joomlack.fr · 1 source · il y a 33 j CRITICAL CVSS 9.3

CVE-2026-77992 heredoc terminator breakout in the calc element in Fabrik < 4.7.2 Extension Joomla — fabrikar.com · 1 source · il y a 34 j CRITICAL CVSS 9.5

CVE-2026-76607 Missing ACL check in download element in Fabrik < 4.7.2. Extension Joomla — fabrikar.com · 1 source · il y a 34 j CRITICAL CVSS 10.0

CVE-2026-76606 Path Traversal via image element in Fabrik < 4.7.2. Extension Joomla — fabrikar.com · 1 source · il y a 34 j CRITICAL CVSS 10.0

CVE-2026-76605 Remote code execution via image element in Fabrik < 4.7.2. Extension Joomla — fabrikar.com · 1 source · il y a 34 j CRITICAL CVSS 10.0

CVE-2026-76604 Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2 Extension Joomla — fabrikar.com · 1 source · il y a 34 j CRITICAL CVSS 10.0

CVE-2026-76602 Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 Extension Joomla — fabrikar.com · 1 source · il y a 34 j CRITICAL CVSS 9.3

CVE-2026-76571 Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 Extension Joomla — fabrikar.com · 1 source · il y a 34 j CRITICAL CVSS 9.3

CVE-2026-75954 SQL injection in trips search in J-BusinessDirectory < 6.2.3 Extension Joomla — cmsjunkie.com · 1 source · il y a 37 j CRITICAL CVSS 9.3

CVE-2026-75949 Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3 Extension Joomla — cmsjunkie.com · 1 source · il y a 37 j CRITICAL CVSS 10.0