Widgetfactorylimited vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Widgetfactorylimited products: 2 record(s), with severity, exploitation and fixes.

Jce 2

Exploited only (KEV) →

CVE-2026-65891 Medium · 6.5 CWE-20 Jul 29, 2026

Improper Input Validation in Widgetfactorylimited Jce

Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) < 2.20.2 - Improper input validation in the file rename functionality allowed an authenticated user with file management permissions to rename files to otherwise invalid names, resulting in the creation of hidden files. The issue also allowed existing files at the destination path to be unintentionally replaced.

CVE-2026-48907 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-284 Jun 5, 2026

Widget Factory Joomla Content Editor Improper Access Control Vulnerability

A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.