Veille CVE

Recherche « regularlabs.com Modules Anywhere extension for Joomla »

6 CVE

Critique 1 Élevée 4 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « regularlabs.com Modules Anywhere extension for Joomla » ✕
  1. CVE-2026-100750 8.5 Élevée

    regularlabs.com Modules Anywhere (Pro) extension for Joomla

    Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla - Modules Anywhere Pro lets additional attributes on a module tag replace arbitrary parameters of the selected module. This feature is enabled by default in affected versions. The overrides are applied without checking who authored the content containing the tag. The security effect depends on how the selected module consumes the replaced parameter. Joomla's core Feed module provides a concrete affected path: its rssurl parameter is opened by the server and accepts local file: URLs as well as network URLs.

  2. CVE-2026-65757 8.1 Élevée

    regularlabs.com Modules Anywhere extension for Joomla

    Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens.

  3. CVE-2026-64795 5.4 Moyenne

    regularlabs.com Modals extension for Joomla · regularlabs.com Tooltips extension for Joomla · regularlabs.com Articles Anywhere Pro extension for Joomla · regularlabs.com Users Anywhere Pro extension for Joomla

    Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’ browsers.

  4. CVE-2026-64793 9.1 Critique

    regularlabs.com Articles Anywhere extension for Joomla · regularlabs.com Modules Anywhere extension for Joomla

    Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions - Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A content author could thereby expose content to visitors who lacked the required access.

  5. CVE-2026-64792 7.5 Élevée

    regularlabs.com Articles Anywhere extension for Joomla · regularlabs.com Conditional Content extension for Joomla · regularlabs.com Modules Anywhere extension for Joomla · regularlabs.com ReReplacer extension for Joomla

    Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions - Smart Search indexing could render generated content using the indexing administrator’s identity instead of a public guest. Restricted or administrator-only content could consequently be stored in the public search index and disclosed to visitors.

  6. CVE-2026-63265 8.0 Élevée

    regularlabs.com Advanced Module Manager extension for Joomla · regularlabs.com Articles Anywhere extension for Joomla · regularlabs.com Articles Field extension for Joomla · regularlabs.com Better Frontend Link extension for Joomla

    Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints - Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization.