Veille CVE

Recherche « yootheme.com YOOtheme Pro extension for Joomla »

5 CVE

Critique 1 Élevée 3 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « yootheme.com YOOtheme Pro extension for Joomla » ✕
  1. CVE-2026-102785 10.0 Critique

    yootheme.com YOOtheme Pro extension for Joomla

    Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.

  2. CVE-2026-77997 5.1 Moyenne

    yootheme.com YOOtheme Pro extension for Joomla

    Joomla Extension - yootheme.com - Authenticated, privileged information disclosure in YOOtheme Pro 1.0.0-5.0.41 - A missing access check allowed users with com_template editing permissions to access information about arbitrary modules without the respective com_modules permissions.

  3. CVE-2026-77996 7.5 Élevée

    yootheme.com YOOtheme Pro extension for Joomla

    Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector.

  4. CVE-2026-76613 8.6 Élevée

    yootheme.com YOOtheme Pro extension for Joomla

    Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries.

  5. CVE-2026-75115 7.0 Élevée

    yootheme.com YOOtheme Pro extension for Joomla

    Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files.