CVE Intelligence

Ollyo vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Ollyo products: 5 record(s), with severity, exploitation and fixes.

Sp Page Builder 2Helix Ultimate 2Helix3 1

Exploited only (KEV) →

CVE-2026-102426 Medium · 6.1 CWE-79 Oct 5, 2026
Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2
Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values are taken from the dc_filter_<fieldId> request parameter, split on the delimiter "l-r", HTML-escaped inside the data-value attribute, and then echoed without escaping as the span element's text content. An unauthenticated attacker reflects arbitrary HTML or JavaScript into the rendered page through a crafted dc_filter_<fieldId> value.
CVE-2026-57830 Critical · 9.1 CWE-862 Jul 13, 2026
Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7
Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthenticated arbitrary file deletion.
CVE-2026-57829 Medium · 6.1 CWE-79 Jul 13, 2026
Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7
Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthenticated stored XSS.
CVE-2026-49049 High · 7.5 Public exploit CWE-284 Jun 29, 2026
Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler
The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters.
CVE-2026-48908 Critical · 9.8 KEV Urgent · 73 Public exploit CWE-434 Jun 20, 2026
JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability
A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.