DJ-Classifieds flaw allowed unauthenticated file uploads
mySites.guru has reported a high-severity file-upload vulnerability in the Joomla extension DJ-Classifieds, which was being probed in the wild before the…
Security
Security releases, vulnerabilities and hardening for Joomla.
Joomla extensions hit by SQL injection and stored XSS flaws
Two Joomla extensions have received security fixes for high-severity, unauthenticated vulnerabilities: SQL injection in JoomCCK and stored cross-site scripting…
jDownloads fixes unauthenticated upload flaw in 4.1.6
jDownloads has fixed a high-severity unauthenticated file-upload vulnerability affecting versions 4.1.0 through 4.1.5. Administrators should update to 4.1.6.
Quix Page Builder SQL injection fixed in version 6.2.2
mySites.guru has disclosed an unauthenticated, error-based SQL injection in ThemeXpert’s Quix Page Builder for Joomla, tracked as CVE-2026-58078 and rated High…
JoomShaper releases security patches for Joomla 3 extensions
JoomShaper has released Joomla 3 security updates for Helix Ultimate, Helix3 and SP Page Builder, reversing its recent decision to stop providing patches for…
DPCalendar reports serious read-only database access flaw
Digital Peak has reported a serious vulnerability in its DPCalendar event-calendar component that can enable unauthorised access to data stored in a Joomla…
JoomShaper Joomla 3 extensions face actively exploited flaws
mySites.guru has reported three security flaws affecting JoomShaper extensions on Joomla 3, including a critical SP Page Builder vulnerability that has been…
EDocman SQL injection fixed in version 3.9.0
mySites.guru has disclosed an unauthenticated SQL injection in the Joomla extension EDocman, allowing database contents to be read remotely. JoomDonation fixed…
Joomla 6.1.2 and 5.4.7 address core security flaws
Joomla has released versions 6.1.2 and 5.4.7 with security fixes for the core and web services, alongside more than 35 bug fixes and stability improvements…
Joomla com_media access flaw fixed in 5.4.7 and 6.1.2
Joomla! CMS installations running 4.1.0-5.4.6 or 6.0.0-6.1.1 are affected by incorrect access control in com_media webservice endpoints; administrators should…
Joomla com_fields access flaw affects 4.x and 6.x
Joomla sites running 4.0.0-5.4.6 or 6.0.0-6.1.1 are affected by an Incorrect Access Control issue in com_fields; administrators should upgrade to 5.4.7 or…
Joomla fixes access control flaw in com_privacy endpoints
Joomla administrators running 4.0.0-5.4.6 or 6.0.0-6.1.1 should upgrade to 5.4.7 or 6.1.2, respectively, to fix CVE-2026-48957 in com_privacy webservice…