Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium5.1Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - Four task handlers accepted a base64-encoded…EPSS 0.5%Aug 21, 2026
- Medium6.3Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another cu…EPSS 0.4%Aug 21, 2026
- High8.7Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any order_id as…EPSS 0.4%Aug 21, 2026
- Medium5.3Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order token cou…EPSS 0.2%Aug 21, 2026
- Medium5.3Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66Aug 21, 2026
- High8.6Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject…Aug 21, 2026
- High8.6Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied field eleme…Aug 21, 2026
- Medium6.9Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66.Aug 21, 2026
- High7.0Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glo…Aug 21, 2026
- Medium4.6Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66Aug 21, 2026
- Unknown[20260810] - Core - Unrestricted uploads of SHTML filesAug 17, 2026
- Unknown[20260809] - Core - Improper ACL checks when injection schema.org contact dataAug 17, 2026
- Unknown[20260808] - Core - Improper ACL checks for batch copy actionsAug 17, 2026
- Unknown[20260807] - Core - MFA Authentication BypassAug 17, 2026
- Unknown[20260806] - Core - XSS through schema.org outputsAug 17, 2026
- Unknown[20260805] - Core - Improper ACL checks for category webservice endpointsAug 17, 2026
- Unknown[20260804] - Core - Improper ACL checks for custom fields webservice endpointsAug 17, 2026
- Unknown[20260803] - Core - Inconsistent ACL checks for mutating webservice endpointsAug 17, 2026
- Unknown[20260802] - Core - Improper CORS origin validationAug 17, 2026
- Critical10.0Balbooa Forms Unrestricted Upload of File with Dangerous Type VulnerabilityKEVEPSS 14.9%Jul 9, 2026
- Critical10.0Joomlack Page Builder Improper Access Control VulnerabilityKEVEPSS 30.9%Jun 29, 2026
- Critical10.0Widget Factory Joomla Content Editor Improper Access Control VulnerabilityKEVEPSS 16.2%Jun 5, 2026
- Medium6.9Lack of input filtering leads to an XSS vector in the HTML filter code.May 26, 2026
- High8.2An improper access check allows privelege escalation through the com_users group editing webservice endpoint.May 26, 2026
- Medium6.9Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components.May 26, 2026