CVE-2026-75953

Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3 - Recipient address was taken from the request (contact_id_offer / contact_id_event) instead of the server-side offer/event record, so mail could be sent to an arbitrary address.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Cmsjunkie.com

Products

J-businessdirectory Extension For Joomla

CVE-2026-75955

Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory < 6.2.3 - companyName from the request was written unescaped into an XML attribute.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Cmsjunkie.com

Products

J-businessdirectory Extension For Joomla

CVE-2026-75951

Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference (multiple frontend/API actions) in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference (multiple frontend/API actions) in J-BusinessDirectory < 6.2.3

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cmsjunkie.com

Products

J-businessdirectory Extension For Joomla

CVE-2026-75956

Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory < 6.2.3 - Pagination values were not strictly typed. Array/non-numeric values (for example limitstart[]) could trigger PHP type errors in arithmetic, and limit was not validated before use in list queries.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Cmsjunkie.com

Products

J-businessdirectory Extension For Joomla

CVE-2026-75954

Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3 - Search keywords and ORDER BY were concatenated into SQL. 6.2.3 quotes keywords and allow-lists the sort clause.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Cmsjunkie.com

Products

J-businessdirectory Extension For Joomla

CVE-2026-75949

Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3 - Upload/remove accepted a client-controlled root (_path_type could point at the component site/admin trees), did not enforce path containment, and used a weak extension check. CSRF token was also missing on upload/remove.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Cmsjunkie.com

Products

J-businessdirectory Extension For Joomla

CVE-2026-75950

Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3 - Ownership could be changed using attacker-supplied company and user IDs, including for listings that already had an owner. 6.2.3 binds the action to the authenticated user and only allows unowned listings.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cmsjunkie.com

Products

J-businessdirectory Extension For Joomla

CVE-2026-75952

Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory < 6.2.3 - Tokens were missing on many AJAX/state-changing tasks: contact/quote forms, cart, bookmarks, uploads, messages, AI text generation, and several administrator actions (app install, demo-data wipe, cache/statistics archive, payment notification send, mobile push). Frontend CSRF needs a registered/listing-owner session; admin CSRF needs a backend admin session.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Cmsjunkie.com

Products

J-businessdirectory Extension For Joomla