Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10

Export CSV
CVE-2026-102426

Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2

Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values are taken from the dc_filter_<fieldId> request parameter, split on the delimiter "l-r", HTML-escaped inside the data-value attribute, and then echoed without escaping as the span element's text content. An unauthenticated attacker reflects arbitrary HTML or JavaScript into the rendered page through a crafted dc_filter_<fieldId> value.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Joomshaper.net Ollyo
Products
Sp Page Builder Extension For Joomla Sp Page Builder
CVE-2026-67287

Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0

Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0 - An unauthenticated attacker can create comments on instances with disabled guest commenting by overriding the setting in question with user supplied input.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Joomshaper.net
Products
Sp Page Builder Extension For Joomla
CVE-2026-67285

Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0

Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0 - An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Joomshaper.net
Products
Sp Page Builder Extension For Joomla
CVE-2026-67286

Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0

Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0 - An unauthenticated attacker can create arbitrary directories and files with a predefined name.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Joomshaper.net
Products
Sp Page Builder Extension For Joomla
CVE-2026-65876

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0 - Improper validation of catid parameters in the loadMoreArticles endpoint leads to an SQL injection vector.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Joomshaper.net
Products
Sp Page Builder Extension For Joomla
CVE-2026-66494

Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0

Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a Joomla site's database via a single HTTP request. When an administrator opens the SP Page Builder editor, the JavaScript executes in their browser automatically..

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Joomshaper.net
Products
Sp Page Builder Extension For Joomla
CVE-2026-65879

Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1

Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Joomshaper.net
Products
Sp Page Builder Extension For Joomla
CVE-2026-65878

Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1

Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1- Improper path validation and ACL checks lead to a file deletion vector in the media manager.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Joomshaper.net
Products
Sp Page Builder Extension For Joomla
CVE-2026-65877

Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1

Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of various parameters in the media manager search and date filters lead to an SQL injection vector.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Joomshaper.net
Products
Sp Page Builder Extension For Joomla