Search
Search Results (11 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-102426 | 1 Joomshaper.net | 1 Sp Page Builder Extension For Joomla | 2026-10-06 | N/A |
| Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values are taken from the dc_filter_<fieldId> request parameter, split on the delimiter "l-r", HTML-escaped inside the data-value attribute, and then echoed without escaping as the span element's text content. An unauthenticated attacker reflects arbitrary HTML or JavaScript into the rendered page through a crafted dc_filter_<fieldId> value. | ||||
| CVE-2026-67287 | 1 Joomshaper.net | 1 Sp Page Builder Extension For Joomla | 2026-08-14 | N/A |
| Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0 - An unauthenticated attacker can create comments on instances with disabled guest commenting by overriding the setting in question with user supplied input. | ||||
| CVE-2026-67285 | 1 Joomshaper.net | 1 Sp Page Builder Extension For Joomla | 2026-08-13 | N/A |
| Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0 - An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system. | ||||
| CVE-2026-67286 | 1 Joomshaper.net | 1 Sp Page Builder Extension For Joomla | 2026-08-13 | N/A |
| Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0 - An unauthenticated attacker can create arbitrary directories and files with a predefined name. | ||||
| CVE-2026-65876 | 1 Joomshaper.net | 1 Sp Page Builder Extension For Joomla | 2026-08-12 | N/A |
| Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0 - Improper validation of catid parameters in the loadMoreArticles endpoint leads to an SQL injection vector. | ||||
| CVE-2026-66494 | 1 Joomshaper.net | 1 Sp Page Builder Extension For Joomla | 2026-08-08 | N/A |
| Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a Joomla site's database via a single HTTP request. When an administrator opens the SP Page Builder editor, the JavaScript executes in their browser automatically.. | ||||
| CVE-2026-65879 | 1 Joomshaper.net | 1 Sp Page Builder Extension For Joomla | 2026-08-03 | 9.8 Critical |
| Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms. | ||||
| CVE-2026-65878 | 1 Joomshaper.net | 1 Sp Page Builder Extension For Joomla | 2026-07-27 | N/A |
| Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1- Improper path validation and ACL checks lead to a file deletion vector in the media manager. | ||||
| CVE-2026-65877 | 1 Joomshaper.net | 1 Sp Page Builder Extension For Joomla | 2026-07-27 | N/A |
| Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of various parameters in the media manager search and date filters lead to an SQL injection vector. | ||||
| CVE-2026-48908 | 2 Joomshaper.net, Ollyo | 2 Sp Page Builder Extension For Joomla, Sp Page Builder | 2026-07-07 | 9.8 Critical |
| A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code. | ||||
| CVE-2026-48909 | 1 Joomshaper.net | 1 Sp Lms Extension For Joomla | 2026-06-22 | N/A |
| SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server. | ||||
Page 1 of 1.