Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8

Export CSV
CVE-2026-74804

Joomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.64

Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64 - The filter_type request value is interpolated into the query as a.type = "..." and the type_filter array as a.type IN ("..."), with no quoting or escaping.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Yootheme.com
Products
Zoo Extension For Joomla
CVE-2026-75114

Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64

Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64 - The referer request parameter is passed straight to setRedirect() with no validation.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Yootheme.com
Products
Zoo Extension For Joomla
CVE-2026-74803

Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64

Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Yootheme.com
Products
Zoo Extension For Joomla
CVE-2026-76610

Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65

Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Yootheme.com
Products
Zoo Extension For Joomla
CVE-2026-77029

Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66

Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Yootheme.com
Products
Zoo Extension For Joomla
CVE-2026-77028

Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66

Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Yootheme.com
Products
Zoo Extension For Joomla
CVE-2026-76611

Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66

Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Yootheme.com
Products
Zoo Extension For Joomla
CVE-2026-76612

Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66

Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Yootheme.com
Products
Zoo Extension For Joomla