Krzysztof Zając, CERT PL

Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3

Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2

Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0

Joomla Extension - j2commerce.com - Reflected XSS attribute in All Video Share 1.0.0-4.5.0

Joomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded < 5.6.1

Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0

Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1

Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1