Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0,...
CVE-2026-97162
Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
#advisory
共收录 23334 条相关情报。
← 返回所有主题Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5...
CVE-2026-97163
Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin...
CVE-2026-97161
Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.
Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin...
CVE-2026-97160
Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0
Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing...
CVE-2026-94131
Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0
Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the...
CVE-2026-100720
Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowest-privileged authen
Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the...
CVE-2026-100719
Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command t
Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension <...
CVE-2026-94130
Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3 - An SQL injectio
Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data...
CVE-2026-100716
Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (DataDump) cron fails
Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP...
CVE-2026-100715
Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task
froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl...
CVE-2026-100717
froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return
kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall...
CVE-2026-100706
kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace
Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting:...
CVE-2026-100714
Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings h
froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA...
CVE-2026-100711
froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user p
Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key...
CVE-2026-100708
Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key content — verbatim in t
Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens)...
CVE-2026-100709
Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the a
Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender...
CVE-2026-100718
Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.add API command. When
Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH...
CVE-2026-100713
Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cr
froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an...
CVE-2026-100712
froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET r
Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(),...
CVE-2026-100710
Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(), Domains::listing(), SubDoma