Средняя
CVSS 5.1
CVE-2026-65763
Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4 - Improper validation of user inputs lead to a reflective XSS vulnerability.
База уязвимостей Joomla
Все CVE Joomla.
В одной базе знаний.
Проверяйте риски раньше, чем они станут инцидентом. Поиск по ядру Joomla и популярным расширениям, оценка CVSS и прямые ссылки на первичные источники.
Динамика уязвимостей
Обновляется
1 419
уязвимостей в общем периоде
170за 3 месяца
85за месяц
57за неделю
Часто встречаются:
JCESP Page BuilderHelix UltimatePageBuilder CKAcyMailingBalbooa FormsEasyStoreEvents BookingDJ-ClassifiedsQuixDPCalendarRSFiles!Phoca DownloadMembership ProJoomCCK
Данные обновлены 24.07.2026 · по Москве
Каталог
Все известные уязвимости
Статус «активна» означает, что запись опубликована в 2026 году. Он не заменяет проверку версии и официального исправления.
Средняя
CVSS 5.1
CVE-2026-65762
Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 - Improper validation of user inputs lead to a reflective XSS vulnerability.
Критическая
CVSS 9.3
CVE-2026-65761
Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read acce…
Критическая
CVSS 9.2
CVE-2026-65760
cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any…
Высокая
CVSS 8.7
CVE-2026-65759
unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical order and payment information, including states, are processed from client side input, enabling unauthen…
Высокая
CVSS 8.2
CVE-2026-65758
Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's subm…
Не оценена
CVSS 0.0
CVE-2026-65757
Разработчикregularlabs.com
Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup could expose restricted module data to authenticated users without the required module per…
Средняя
CVSS 6.1
CVE-2026-65756
Разработчикregularlabs.com
XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript.
Не оценена
CVSS 0.0
CVE-2026-65755
Разработчикregularlabs.com
Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension - Date-sensitive query cache keys did not retain a bounded time component. Cached results could remain a…
Не оценена
CVSS 0.0
CVE-2026-65754
Разработчикregularlabs.com
Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory.
Не оценена
CVSS 0.0
CVE-2026-65713
Разработчикregularlabs.com
Insecure path handling in Modals Pro extension - Modals gallery paths could enumerate unintended directories.
Не оценена
CVSS 0.0
CVE-2026-65712
Разработчикregularlabs.com
Insecure path handling in CDN for Joomla Pro extension - CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata.
Не оценена
CVSS 0.0
CVE-2026-65431
Разработчикregularlabs.com
Zipslip in GeoIP extension - Geo IP database update archives have been broadly extracted without path validation, leading to unsafe file extractions.
Не оценена
CVSS 0.0
CVE-2026-65430
Разработчикregularlabs.com
MaxMind Credential leakage in GeoIP extension - MaxMind credentials where leaked in request URLs, causing a credential leakage vulnerability.
Не оценена
CVSS 0.0
CVE-2026-64876
Разработчикregularlabs.com
Inconsistent CSRF token checks / privilege checks in GeoIP extension - Database-update requests lacked consistent token and Super User checks, this could cause unauthorized updates.
Не оценена
CVSS 0.0
CVE-2026-64875
Разработчикregularlabs.com
IP spoofing vulnerability in GeoIP extension - GeoIP lookups trusted spoofable forwarded client-IP headers, this could cause GeoIP-rule bypass.
Не оценена
CVSS 0.0
CVE-2026-64874
Разработчикregularlabs.com
CDN Credential leakage Cache Cleaner Pro extension - CDN credentials were exposed in administrator request URLs.
Не оценена
CVSS 0.0
CVE-2026-64873
Разработчикregularlabs.com
SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services.