Vulnerabilidades de Regularlabs.com
CVEs publicadas que afetam produtos de Regularlabs.com: 30 registro(s), com severidade, exploração e correções.
Articles Anywhere extension for Joomla 5Conditional Content extension for Joomla 5GeoIP extension for Joomla 5Sourcerer extension for Joomla 4Advanced Module Manager extension for Joomla 4Modules Anywhere extension for Joomla 4ReReplacer extension for Joomla 3Cache Cleaner Pro extension for Joomla 3ReReplacer extension Pro for Joomla 3Content Templater Pro extension for Joomla 3Users Anywhere extension for Joomla 3IP Login extension for Joomla 3Keyboard Shortcuts extension for Joomla 2Users Anywhere Pro extension for Joomla 2Articles Anywhere Pro extension for Joomla 2Cache Cleaner extension for Joomla 2Tooltips extension for Joomla 2Content Templater extension for Joomla 2Snippets extension for Joomla 2DB Replacer extension for Joomla 2Modals extension for Joomla 2Regular Labs Extension Manager extension for Joomla 2Quick Index extension for Joomla 1CDN for Joomla extension for Joomla 1What? Nothing! extension for Joomla 1Email Protector extension for Joomla 1Better Frontend Link extension for Joomla 1Tabs & Accordions Pro extension for Joomla 1Snippets Pro extension for Joomla 1Modules Anywhere Pro extension for Joomla 1Articles Field extension for Joomla 1CDN for Joomla Pro extension for Joomla 1Modals Pro extension for Joomla 1ReReplacer PRo extension for Joomla 1
CVE-2026-74253
Crítica · 10.0
CWE-94 17/08/2026
Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 16.0.0
Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 16.0.0 - Regular Labs Sourcerer before 16.0.0 processes {source} blocks found in Joomla’s final rendered HTML without reliably determining where that code originated.
CVE-2026-65757
Alta · 8.1
CWE-284 23/07/2026
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens.
CVE-2026-65756
Média · 6.1
CWE-79 23/07/2026
Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension
Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript.
CVE-2026-65755
Alta · 7.5
CWE-524 23/07/2026
Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension
Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension - Date-sensitive query cache keys did not retain a bounded time component. Cached results could remain active across future publication or expiry boundaries, potentially exposing content after it should become unavailable.
CVE-2026-65754
Alta · 7.5
CWE-22 23/07/2026
Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension
Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory.
CVE-2026-65713
Média · 6.5
CWE-22 23/07/2026
Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension
Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension - Modals gallery paths could enumerate unintended directories.
CVE-2026-65712
Média · 6.2
CWE-22 23/07/2026
Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension
Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension - CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata.
CVE-2026-65431
Crítica · 9.8
CWE-22 23/07/2026
Joomla Extension - regularlabs.com - Zipslip in GeoIP extension
Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP database update archives have been broadly extracted without path validation, leading to unsafe file extractions.
CVE-2026-65430
Alta · 7.5
CWE-200 23/07/2026
Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension
Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension - MaxMind credentials where leaked in request URLs, causing a credential leakage vulnerability.
CVE-2026-64876
Alta · 8.8
CWE-284 23/07/2026
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension - Database-update requests lacked consistent token and Super User checks, this could cause unauthorized updates.
CVE-2026-64875
Média · 6.5
CWE-290 23/07/2026
Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension
Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension - GeoIP lookups trusted spoofable forwarded client-IP headers, this could cause GeoIP-rule bypass.
CVE-2026-64874
Crítica · 9.8
CWE-200 23/07/2026
Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension
Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN credentials were exposed in administrator request URLs.
CVE-2026-64873
Crítica · 9.8
CWE-918 23/07/2026
Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension
Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services.
CVE-2026-64872
Média · 6.5
CWE-22 23/07/2026
Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension
Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension - Custom purge and log paths could escape the site webroot directory.
CVE-2026-64871
Média · 5.4
CWE-284 23/07/2026
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension - Administrator URL purges did not consistently require a valid token and cache-management permission.
CVE-2026-64799
Alta · 7.5
CWE-918 23/07/2026
Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions
Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This could result in SSRF, internal-data access or writing attacker-controlled files into a web-accessible folder.
CVE-2026-64798
Crítica · 9.1
CWE-338 22/07/2026
Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension
Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy.
CVE-2026-64797
Alta · 7.5
CWE-290 22/07/2026
Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension
Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and potentially impersonate mapped accounts.
CVE-2026-64796
Crítica · 9.8
CWE-284 22/07/2026
Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension
Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured include folder, and executable script/style variants could bypass detection.
CVE-2026-64795
Média · 5.4
CWE-79 22/07/2026
Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions
Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’ browsers.
CVE-2026-64794
Média · 6.5
CWE-284 22/07/2026
Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions
Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions - User tags, filters and conditions allowed access to insufficiently restricted user fields. Crafted content could expose authentication-related data, raw user parameters or restricted contact details.
CVE-2026-64793
Crítica · 9.1
CWE-284 22/07/2026
Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions
Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions - Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A content author could thereby expose content to visitors who lacked the required access.
CVE-2026-64792
Alta · 7.5
CWE-524 22/07/2026
Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions
Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions - Smart Search indexing could render generated content using the indexing administrator’s identity instead of a public guest. Restricted or administrator-only content could consequently be stored in the public search index and disclosed to visitors.
CVE-2026-64791
Alta · 8.8
CWE-284 22/07/2026
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager - Administrator routes and install/update/uninstall processing did not consistently enforce component-management and installation permissions. An unauthorized backend user or CSRF attack could install, update or remove extensions.
CVE-2026-63685
Alta · 8.8
CWE-284 22/07/2026
Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension
Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension - Administrator routes and replacement requests did not consistently require Super User permission and a valid token. An unauthorized backend user or CSRF attack could perform database replacements, potentially causing major data corruption or site compromise.