Catalog
Findings
Filter by record type (vulnerability, fix, incident, intelligence, research), severity, source, stack, and weakness.
- UnknownUnrestricted Upload of File with Dangerous TypeKEVEPSS 0.4%Sep 22, 2026
- UnknownJoomla! Joomla! Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')KEVEPSS 99.8%Sep 11, 2026
- High8.6Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2Commerce 4.1.5 is vulnerable to Stored Cross-Si…EPSS 0.5%Aug 21, 2026
- Medium5.1Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - Four task handlers accepted a base64-encoded…EPSS 0.5%Aug 21, 2026
- Medium6.3Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another cu…EPSS 0.4%Aug 21, 2026
- High8.7Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any order_id as…EPSS 0.4%Aug 21, 2026
- Medium5.3Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order token cou…EPSS 0.2%Aug 21, 2026
- Medium5.3Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66EPSS 0.4%Aug 21, 2026
- High8.6Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject…EPSS 0.4%Aug 21, 2026
- High8.6Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied field eleme…EPSS 0.4%Aug 21, 2026
- Medium6.9Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66.EPSS 0.5%Aug 21, 2026
- High7.0Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glo…EPSS 0.5%Aug 21, 2026
- Medium4.6Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66EPSS 0.2%Aug 21, 2026
- Unknown[20260810] - Core - Unrestricted uploads of SHTML filesEPSS 0.6%Aug 17, 2026
- Unknown[20260809] - Core - Improper ACL checks when injection schema.org contact dataEPSS 0.3%Aug 17, 2026
- Unknown[20260808] - Core - Improper ACL checks for batch copy actionsEPSS 0.3%Aug 17, 2026
- Unknown[20260807] - Core - MFA Authentication BypassEPSS 0.5%Aug 17, 2026
- Unknown[20260806] - Core - XSS through schema.org outputsEPSS 0.3%Aug 17, 2026
- Unknown[20260805] - Core - Improper ACL checks for category webservice endpointsEPSS 0.3%Aug 17, 2026
- Unknown[20260804] - Core - Improper ACL checks for custom fields webservice endpointsEPSS 0.3%Aug 17, 2026
- Unknown[20260803] - Core - Inconsistent ACL checks for mutating webservice endpointsEPSS 0.3%Aug 17, 2026
- Unknown[20260802] - Core - Improper CORS origin validationEPSS 0.3%Aug 17, 2026
- Unknownollyo helix3 Improper Access ControlKEVEPSS 1.0%Aug 11, 2026
- Unknownbalbooa gridbox Unrestricted Upload of File with Dangerous TypeKEVEPSS 0.5%Jul 29, 2026
- Unknownbalbooa gridbox Improper Access ControlKEVEPSS 0.5%Jul 29, 2026