Veille CVE

Recherche « yootheme.com Zoo extension for Joomla »

8 CVE

Critique 2 Élevée 1 Moyenne 5 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « yootheme.com Zoo extension for Joomla » ✕
  1. CVE-2026-77028 5.3 Moyenne

    yootheme.com Zoo extension for Joomla

    Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66

  2. CVE-2026-76612 8.6 Élevée

    yootheme.com Zoo extension for Joomla

    Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector.

  3. CVE-2026-76611 6.9 Moyenne

    yootheme.com Zoo extension for Joomla

    Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66.

  4. CVE-2026-77029 4.6 Moyenne

    yootheme.com Zoo extension for Joomla

    Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66

  5. CVE-2026-76610 6.9 Moyenne

    yootheme.com Zoo extension for Joomla

    Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users.

  6. CVE-2026-75114 5.1 Moyenne

    yootheme.com Zoo extension for Joomla

    Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64 - The referer request parameter is passed straight to setRedirect() with no validation.

  7. CVE-2026-74804 9.3 Critique

    yootheme.com Zoo extension for Joomla

    Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64 - The filter_type request value is interpolated into the query as a.type = "..." and the type_filter array as a.type IN ("..."), with no quoting or escaping.

  8. CVE-2026-74803 10.0 Critique

    yootheme.com Zoo extension for Joomla

    Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group.