Search
Search Results (3 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-100750 | 2 Regularlabs, Regularlabs.com | 2 Modules Anywhere, Modules Anywhere Pro Extension For Joomla | 2026-10-27 | 7.5 High |
| Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla - Modules Anywhere Pro lets additional attributes on a module tag replace arbitrary parameters of the selected module. This feature is enabled by default in affected versions. The overrides are applied without checking who authored the content containing the tag. The security effect depends on how the selected module consumes the replaced parameter. Joomla's core Feed module provides a concrete affected path: its rssurl parameter is opened by the server and accepts local file: URLs as well as network URLs. | ||||
| CVE-2026-100751 | 2 Regularlabs, Regularlabs.com | 2 Tabs \& Accordions, Tabs & Accordions Pro Extension For Joomla | 2026-10-27 | 6.1 Medium |
| Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions (Pro) 2.3.0 - 3.1.0 - Tabs & Accordions Pro accepts a url option for an item and writes it to a generated data-rlta-url attribute. The browser code passes that value to window.open() when the item is activated. Affected versions do not reject browser URL schemes which execute JavaScript. Joomla sees ordinary plugin syntax while filtering the authored article; Tabs & Accordions creates the executable browser behavior later while rendering the article. | ||||
| CVE-2025-22204 | 1 Regularlabs | 1 Sourcerer | 2025-06-04 | 9.8 Critical |
| Improper control of generation of code in the sourcerer extension for Joomla in versions before 11.0.0 lead to a remote code execution vulnerability. | ||||
Page 1 of 1.