tag
Joomla
Joomla Helix Ultimate Framework — Unauthenticated Arbitrary File Deletion (CVE-2026-57830)
Helix Ultimate's plugins/system/helixultimate/src/Platform/Media.php exposes deleteMedia() and getFolders() through the Joomla comajax dispatch hook (onAfterRoute()), reachable via option=comajax&helix=ultimate&action=delete-media/view-media. These methods…
Joomla Balbooa Forms Unauthenticated Arbitrary File Upload → RCE (CVE-2026-56291)
Balbooa Forms is a popular drag-and-drop form builder extension for Joomla!. Its form.uploadAttachmentFile task — reachable via the unauthenticated combaforms component entry point — accepts multipart file uploads for form attachments but performs neither a…
Unauthenticated Arbitrary File Upload RCE in iCagenda for Joomla (CVE-2026-48939)
iCagenda's frontend event-registration form includes an optional file-attachment field. The "Registered Only" access restriction meant to gate that field is enforced only in the view layer that decides whether to render the form — the registration.submit…
SP LMS PHP Object Injection → Unauthenticated RCE (CVE-2026-48909)
SP LMS's cart model (components/comsplms/models/cart.php) reads the lmsOrders cookie, base64-decodes it, and passes the result directly to PHP's unserialize() with no validation, giving an unauthenticated attacker full control over the deserialized object…
Joomla Page Builder CK Unauthenticated Arbitrary File Upload RCE — CVE-2026-56290
The Joomla extension Page Builder CK exposes a controller method, browse.ajaxAddPicture, that accepts file uploads with a user-controlled destination path parameter (path) that is only passed through trim() — no whitelist, extension check, or…
Joomla Novarain Framework (nrframework) Unauthenticated Arbitrary File Inclusion — CVE-2026-21627
The ajaxTaskInclude() method of the nrframework Joomla plugin is explicitly whitelisted for unauthenticated frontend AJAX access and accepts attacker-controlled path, file, and class parameters. The path parameter uses Joomla's RAW input filter (no…
JoomCCK Unauthenticated SQL Injection via `tags.save` (CVE-2026-49048)
JoomCCK's custom MVC dispatcher (MControllerBase::execute()) invokes controller tasks without any CSRF token check or ACL/authorization check — its authorise() method is a no-op that always returns true. This makes the tags.save task, whose model method…
Unauthenticated RCE in Joomla Content Editor (JCE) Profile Import (CVE-2026-48907)
CVE-2026-48907 is a critical improper access control vulnerability in the JCE extension for Joomla. The profile import workflow (index.php?option=comjce&task=profiles.import) is missing sufficient authorization checks, letting unauthenticated users create new…
SP Page Builder (Joomla) Unauthenticated File Upload RCE (CVE-2026-48908)
CVE-2026-48908 is a CVSS 10.0 unauthenticated remote code execution vulnerability in SP Page Builder, one of the most widely used Joomla page-builder extensions (joomshaper.net). The asset.uploadCustomIcon endpoint enforces no authentication, no…