Search
Find a vulnerability
Search criteria
31 vulnerabilities by regularlabs.com
CVE-2026-74253 (GCVE-0-2026-74253)
Vulnerability from nvd – Published: 2026-08-17 17:12 – Updated: 2026-08-17 17:37
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 14.0.0
Summary
Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 14.0.0 - Regular Labs Sourcerer before 14.0.0 processes {source} blocks found in Joomla’s final rendered HTML without reliably determining where that code originated.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 17:37 UTC
CWE
- CWE-94 - Improper Control of Generation of Code
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | Sourcerer extension for Joomla |
Affected:
1.0.0-13.1.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74253",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T17:37:17.043957Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T17:37:26.797Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Sourcerer extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-13.1.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "\u0141ukasz Rybak"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer \u003c 14.0.0 - Regular Labs Sourcerer before 14.0.0 processes {source} blocks found in Joomla\u2019s final rendered HTML without reliably determining where that code originated."
}
],
"value": "Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer \u003c 14.0.0 - Regular Labs Sourcerer before 14.0.0 processes {source} blocks found in Joomla\u2019s final rendered HTML without reliably determining where that code originated."
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242: Code Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T17:12:55.129Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer \u003c 14.0.0",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-74253",
"datePublished": "2026-08-17T17:12:55.129Z",
"dateReserved": "2026-08-15T04:38:57.663Z",
"dateUpdated": "2026-08-17T17:37:26.797Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65757 (GCVE-0-2026-65757)
Vulnerability from nvd – Published: 2026-07-23 09:14 – Updated: 2026-07-25 05:34
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension
Summary
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-24 20:01 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | Modules Anywhere extension for Joomla |
Affected:
1.0.0-8.4.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-65757",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T20:01:56.979366Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T20:02:14.964Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Modules Anywhere extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-8.4.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens."
}
],
"value": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T05:34:17.823Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-65757",
"datePublished": "2026-07-23T09:14:12.872Z",
"dateReserved": "2026-07-22T20:46:13.953Z",
"dateUpdated": "2026-07-25T05:34:17.823Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65756 (GCVE-0-2026-65756)
Vulnerability from nvd – Published: 2026-07-23 09:11 – Updated: 2026-07-24 07:17
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension
Summary
Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-23 19:08 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | Keyboard Shortcuts extension for Joomla |
Affected:
1.0.0-3.2.5
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-65756",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-23T19:08:25.299517Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T19:08:45.691Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Keyboard Shortcuts extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-3.2.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript."
}
],
"value": "Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T07:17:56.388Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-65756",
"datePublished": "2026-07-23T09:11:48.636Z",
"dateReserved": "2026-07-22T20:46:13.953Z",
"dateUpdated": "2026-07-24T07:17:56.388Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65755 (GCVE-0-2026-65755)
Vulnerability from nvd – Published: 2026-07-23 09:14 – Updated: 2026-07-29 05:40
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension
Summary
Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension - Date-sensitive query cache keys did not retain a bounded time component. Cached results could remain active across future publication or expiry boundaries, potentially exposing content after it should become unavailable.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 14:23 UTC
CWE
- CWE-524 - Use of Cache Containing Sensitive Information
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | Articles Anywhere extension for Joomla |
Affected:
1.0.0-18.0.2
|
|
| regularlabs.com | Users Anywhere extension for Joomla |
Affected:
1.0.0-1.2.7
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-65755",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T14:23:50.957743Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T14:55:44.097Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Articles Anywhere extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-18.0.2"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Users Anywhere extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-1.2.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension - Date-sensitive query cache keys did not retain a bounded time component. Cached results could remain active across future publication or expiry boundaries, potentially exposing content after it should become unavailable."
}
],
"value": "Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension - Date-sensitive query cache keys did not retain a bounded time component. Cached results could remain active across future publication or expiry boundaries, potentially exposing content after it should become unavailable."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-524",
"description": "CWE-524 Use of Cache Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T05:40:11.634Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-65755",
"datePublished": "2026-07-23T09:14:11.923Z",
"dateReserved": "2026-07-22T20:46:13.953Z",
"dateUpdated": "2026-07-29T05:40:11.634Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65754 (GCVE-0-2026-65754)
Vulnerability from nvd – Published: 2026-07-23 09:13 – Updated: 2026-07-29 05:39
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension
Summary
Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 14:13 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | ReReplacer PRo extension for Joomla |
Affected:
1.0.0-15.0.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-65754",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T14:13:54.939259Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T14:55:50.445Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ReReplacer PRo extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-15.0.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory."
}
],
"value": "Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T05:39:51.063Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-65754",
"datePublished": "2026-07-23T09:13:56.352Z",
"dateReserved": "2026-07-22T20:46:13.953Z",
"dateUpdated": "2026-07-29T05:39:51.063Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65713 (GCVE-0-2026-65713)
Vulnerability from nvd – Published: 2026-07-23 09:15 – Updated: 2026-07-25 05:35
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension
Summary
Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension - Modals gallery paths could enumerate unintended directories.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-24 19:38 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | Modals Pro extension for Joomla |
Affected:
1.0.0-15.0.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-65713",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T19:38:00.689453Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T19:38:23.960Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Modals Pro extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-15.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension - Modals gallery paths could enumerate unintended directories."
}
],
"value": "Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension - Modals gallery paths could enumerate unintended directories."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T05:35:22.795Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-65713",
"datePublished": "2026-07-23T09:15:13.463Z",
"dateReserved": "2026-07-22T20:27:32.366Z",
"dateUpdated": "2026-07-25T05:35:22.795Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65712 (GCVE-0-2026-65712)
Vulnerability from nvd – Published: 2026-07-23 09:11 – Updated: 2026-07-25 05:32
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension
Summary
Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension - CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata.
Severity
6.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-24 19:34 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | CDN for Joomla Pro extension for Joomla |
Affected:
1.0.0-7.3.7
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-65712",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T19:34:13.823332Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T19:34:34.975Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CDN for Joomla Pro extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-7.3.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension - CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata."
}
],
"value": "Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension - CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T05:32:00.664Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-65712",
"datePublished": "2026-07-23T09:11:52.342Z",
"dateReserved": "2026-07-22T20:27:32.365Z",
"dateUpdated": "2026-07-25T05:32:00.664Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65431 (GCVE-0-2026-65431)
Vulnerability from nvd – Published: 2026-07-23 09:09 – Updated: 2026-07-28 05:30
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - Zipslip in GeoIP extension
Summary
Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP database update archives have been broadly extracted without path validation, leading to unsafe file extractions.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-27 16:40 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | GeoIP extension for Joomla |
Affected:
1.0.0-6.3.8
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-65431",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T16:40:37.912814Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T16:40:41.820Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "GeoIP extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-6.3.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP database update archives have been broadly extracted without path validation, leading to unsafe file extractions."
}
],
"value": "Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP database update archives have been broadly extracted without path validation, leading to unsafe file extractions."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T05:30:43.017Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - Zipslip in GeoIP extension",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-65431",
"datePublished": "2026-07-23T09:09:37.365Z",
"dateReserved": "2026-07-22T07:06:47.089Z",
"dateUpdated": "2026-07-28T05:30:43.017Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65430 (GCVE-0-2026-65430)
Vulnerability from nvd – Published: 2026-07-23 09:10 – Updated: 2026-07-27 13:47
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension
Summary
Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension - MaxMind credentials where leaked in request URLs, causing a credential leakage vulnerability.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-27 13:29 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | GeoIP extension for Joomla |
Affected:
1.0.0-6.3.8
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-65430",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T13:29:01.585591Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T13:29:23.614Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "GeoIP extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-6.3.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension - MaxMind credentials where leaked in request URLs, causing a credential leakage vulnerability."
}
],
"value": "Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension - MaxMind credentials where leaked in request URLs, causing a credential leakage vulnerability."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T13:47:43.782Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-65430",
"datePublished": "2026-07-23T09:10:32.150Z",
"dateReserved": "2026-07-22T07:06:47.089Z",
"dateUpdated": "2026-07-27T13:47:43.782Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64876 (GCVE-0-2026-64876)
Vulnerability from nvd – Published: 2026-07-23 09:12 – Updated: 2026-07-29 05:38
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension
Summary
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension - Database-update requests lacked consistent token and Super User checks, this could cause unauthorized updates.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 14:12 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | GeoIP extension for Joomla |
Affected:
1.0.0-6.3.8
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-64876",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T14:12:55.807327Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T14:55:56.748Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "GeoIP extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-6.3.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension - Database-update requests lacked consistent token and Super User checks, this could cause unauthorized updates."
}
],
"value": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension - Database-update requests lacked consistent token and Super User checks, this could cause unauthorized updates."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T05:38:42.253Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-64876",
"datePublished": "2026-07-23T09:12:50.726Z",
"dateReserved": "2026-07-20T18:46:40.119Z",
"dateUpdated": "2026-07-29T05:38:42.253Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64875 (GCVE-0-2026-64875)
Vulnerability from nvd – Published: 2026-07-23 09:13 – Updated: 2026-07-27 13:32
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension
Summary
Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension - GeoIP lookups trusted spoofable forwarded client-IP headers, this could cause GeoIP-rule bypass.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-27 13:26 UTC
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | GeoIP extension for Joomla |
Affected:
1.0.0-6.3.8
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-64875",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T13:26:02.959421Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T13:26:25.131Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "GeoIP extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-6.3.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension - GeoIP lookups trusted spoofable forwarded client-IP headers, this could cause GeoIP-rule bypass."
}
],
"value": "Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension - GeoIP lookups trusted spoofable forwarded client-IP headers, this could cause GeoIP-rule bypass."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T13:32:38.703Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-64875",
"datePublished": "2026-07-23T09:13:55.404Z",
"dateReserved": "2026-07-20T18:46:40.119Z",
"dateUpdated": "2026-07-27T13:32:38.703Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64874 (GCVE-0-2026-64874)
Vulnerability from nvd – Published: 2026-07-23 09:11 – Updated: 2026-07-27 13:29
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension
Summary
Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN credentials were exposed in administrator request URLs.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-27 13:27 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | Cache Cleaner Pro extension for Joomla |
Affected:
1.0.0-9.7.6
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-64874",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T13:27:44.752121Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T13:28:10.447Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cache Cleaner Pro extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-9.7.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN credentials were exposed in administrator request URLs."
}
],
"value": "Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN credentials were exposed in administrator request URLs."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T13:29:53.752Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-64874",
"datePublished": "2026-07-23T09:11:18.832Z",
"dateReserved": "2026-07-20T18:35:16.486Z",
"dateUpdated": "2026-07-27T13:29:53.752Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64873 (GCVE-0-2026-64873)
Vulnerability from nvd – Published: 2026-07-23 09:14 – Updated: 2026-07-25 05:34
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension
Summary
Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-24 19:37 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | Cache Cleaner Pro extension for Joomla |
Affected:
1.0.0-9.7.6
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-64873",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T19:37:18.791455Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T19:37:43.430Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cache Cleaner Pro extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-9.7.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services."
}
],
"value": "Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T05:34:58.799Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-64873",
"datePublished": "2026-07-23T09:14:50.435Z",
"dateReserved": "2026-07-20T18:35:16.486Z",
"dateUpdated": "2026-07-25T05:34:58.799Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64872 (GCVE-0-2026-64872)
Vulnerability from nvd – Published: 2026-07-23 09:12 – Updated: 2026-07-25 05:32
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension
Summary
Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension - Custom purge and log paths could escape the site webroot directory.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-24 19:35 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | Cache Cleaner Pro extension for Joomla |
Affected:
1.0.0-9.7.6
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-64872",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T19:35:16.668299Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T19:35:57.340Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cache Cleaner Pro extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-9.7.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension - Custom purge and log paths could escape the site webroot directory."
}
],
"value": "Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension - Custom purge and log paths could escape the site webroot directory."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T05:32:14.906Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-64872",
"datePublished": "2026-07-23T09:12:05.620Z",
"dateReserved": "2026-07-20T18:35:16.486Z",
"dateUpdated": "2026-07-25T05:32:14.906Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64871 (GCVE-0-2026-64871)
Vulnerability from nvd – Published: 2026-07-23 09:14 – Updated: 2026-07-25 05:34
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension
Summary
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension - Administrator URL purges did not consistently require a valid token and cache-management permission.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-24 19:36 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | Cache Cleaner extension for Joomla |
Affected:
1.0.0-9.7.6
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-64871",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T19:36:16.175360Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T19:36:42.178Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cache Cleaner extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-9.7.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension - Administrator URL purges did not consistently require a valid token and cache-management permission."
}
],
"value": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension - Administrator URL purges did not consistently require a valid token and cache-management permission."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T05:34:34.817Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-64871",
"datePublished": "2026-07-23T09:14:27.579Z",
"dateReserved": "2026-07-20T18:35:16.486Z",
"dateUpdated": "2026-07-25T05:34:34.817Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64799 (GCVE-0-2026-64799)
Vulnerability from nvd – Published: 2026-07-23 09:11 – Updated: 2026-07-28 05:32
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions
Summary
Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This could result in SSRF, internal-data access or writing attacker-controlled files into a web-accessible folder.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-27 16:38 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | Articles Anywhere Pro extension for Joomla |
Affected:
1.0.0-18.0.2
|
|
| regularlabs.com | Users Anywhere Pro extension for Joomla |
Affected:
1.0.0-1.2.7
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-64799",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T16:38:22.847697Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T16:38:44.297Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Articles Anywhere Pro extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-18.0.2"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Users Anywhere Pro extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-1.2.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This could result in SSRF, internal-data access or writing attacker-controlled files into a web-accessible folder."
}
],
"value": "Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This could result in SSRF, internal-data access or writing attacker-controlled files into a web-accessible folder."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T05:32:38.511Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-64799",
"datePublished": "2026-07-23T09:11:12.311Z",
"dateReserved": "2026-07-20T18:16:31.593Z",
"dateUpdated": "2026-07-28T05:32:38.511Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64798 (GCVE-0-2026-64798)
Vulnerability from nvd – Published: 2026-07-22 20:41 – Updated: 2026-07-28 05:33
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension
Summary
Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-27 17:38 UTC
CWE
- CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | IP Login extension for Joomla |
Affected:
1.0.0-6.2.5
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-64798",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T17:38:17.413844Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T17:38:36.394Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IP Login extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-6.2.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy."
}
],
"value": "Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-338",
"description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T05:33:04.140Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-64798",
"datePublished": "2026-07-22T20:41:53.448Z",
"dateReserved": "2026-07-20T18:16:31.593Z",
"dateUpdated": "2026-07-28T05:33:04.140Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64797 (GCVE-0-2026-64797)
Vulnerability from nvd – Published: 2026-07-22 20:44 – Updated: 2026-07-29 05:39
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension
Summary
Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and potentially impersonate mapped accounts.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 14:07 UTC
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | IP Login extension for Joomla |
Affected:
1.0.0-6.2.5
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-64797",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T14:07:57.833780Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T14:56:11.418Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IP Login extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-6.2.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and potentially impersonate mapped accounts."
}
],
"value": "Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and potentially impersonate mapped accounts."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T05:39:44.152Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-64797",
"datePublished": "2026-07-22T20:44:08.843Z",
"dateReserved": "2026-07-20T18:16:31.593Z",
"dateUpdated": "2026-07-29T05:39:44.152Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64796 (GCVE-0-2026-64796)
Vulnerability from nvd – Published: 2026-07-22 20:42 – Updated: 2026-07-28 05:34
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension
Summary
Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured include folder, and executable script/style variants could bypass detection.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-27 18:43 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | Sourcerer extension for Joomla |
Affected:
1.0.0-12.2.8
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-64796",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T18:43:32.469953Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T18:43:50.952Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Sourcerer extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-12.2.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured include folder, and executable script/style variants could bypass detection."
}
],
"value": "Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured include folder, and executable script/style variants could bypass detection."
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242: Code Injection"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T05:34:08.793Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-64796",
"datePublished": "2026-07-22T20:42:49.934Z",
"dateReserved": "2026-07-20T18:16:31.593Z",
"dateUpdated": "2026-07-28T05:34:08.793Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64795 (GCVE-0-2026-64795)
Vulnerability from nvd – Published: 2026-07-22 20:41 – Updated: 2026-07-27 13:29
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions
Summary
Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’ browsers.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-27 13:24 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | Modals extension for Joomla |
Affected:
1.0.0-15.0.0
|
|
| regularlabs.com | Tooltips extension for Joomla |
Affected:
1.0.0-9.4.7
|
|
| regularlabs.com | Articles Anywhere Pro extension for Joomla |
Affected:
1.0.0-18.0.2
|
|
| regularlabs.com | Users Anywhere Pro extension for Joomla |
Affected:
1.0.0-1.2.7
|
|
| regularlabs.com | Modules Anywhere Pro extension for Joomla |
Affected:
1.0.0-8.4.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-64795",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T13:24:53.127808Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T13:25:17.665Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Modals extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-15.0.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tooltips extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-9.4.7"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Articles Anywhere Pro extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-18.0.2"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Users Anywhere Pro extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-1.2.7"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Modules Anywhere Pro extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-8.4.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors\u2019 browsers."
}
],
"value": "Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors\u2019 browsers."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T13:29:26.815Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-64795",
"datePublished": "2026-07-22T20:41:19.007Z",
"dateReserved": "2026-07-20T18:16:31.592Z",
"dateUpdated": "2026-07-27T13:29:26.815Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64794 (GCVE-0-2026-64794)
Vulnerability from nvd – Published: 2026-07-22 20:45 – Updated: 2026-07-27 13:34
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions
Summary
Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions - User tags, filters and conditions allowed access to insufficiently restricted user fields. Crafted content could expose authentication-related data, raw user parameters or restricted contact details.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-27 13:31 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | Articles Anywhere extension for Joomla |
Affected:
1.0.0-18.0.2
|
|
| regularlabs.com | Users Anywhere extension for Joomla |
Affected:
1.0.0-1.2.7
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-64794",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T13:31:03.747894Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T13:31:32.543Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Articles Anywhere extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-18.0.2"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Users Anywhere extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-1.2.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions - User tags, filters and conditions allowed access to insufficiently restricted user fields. Crafted content could expose authentication-related data, raw user parameters or restricted contact details."
}
],
"value": "Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions - User tags, filters and conditions allowed access to insufficiently restricted user fields. Crafted content could expose authentication-related data, raw user parameters or restricted contact details."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T13:34:11.997Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-64794",
"datePublished": "2026-07-22T20:45:24.135Z",
"dateReserved": "2026-07-20T18:16:31.592Z",
"dateUpdated": "2026-07-27T13:34:11.997Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64793 (GCVE-0-2026-64793)
Vulnerability from nvd – Published: 2026-07-22 20:45 – Updated: 2026-07-27 13:34
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions
Summary
Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions - Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A content author could thereby expose content to visitors who lacked the required access.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-27 13:30 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | Articles Anywhere extension for Joomla |
Affected:
1.0.0-18.0.2
|
|
| regularlabs.com | Modules Anywhere extension for Joomla |
Affected:
1.0.0-8.4.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-64793",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T13:30:03.613540Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T13:30:27.435Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Articles Anywhere extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-18.0.2"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Modules Anywhere extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-8.4.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions - Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A content author could thereby expose content to visitors who lacked the required access."
}
],
"value": "Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions - Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A content author could thereby expose content to visitors who lacked the required access."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T13:34:13.847Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-64793",
"datePublished": "2026-07-22T20:45:25.099Z",
"dateReserved": "2026-07-20T18:16:31.592Z",
"dateUpdated": "2026-07-27T13:34:13.847Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64792 (GCVE-0-2026-64792)
Vulnerability from nvd – Published: 2026-07-22 20:40 – Updated: 2026-07-28 05:31
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions
Summary
Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions - Smart Search indexing could render generated content using the indexing administrator’s identity instead of a public guest. Restricted or administrator-only content could consequently be stored in the public search index and disclosed to visitors.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-27 17:37 UTC
CWE
- CWE-524 - Use of Cache Containing Sensitive Information
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | Articles Anywhere extension for Joomla |
Affected:
1.0.0-18.0.2
|
|
| regularlabs.com | Conditional Content extension for Joomla |
Affected:
1.0.0-6.0.0
|
|
| regularlabs.com | Modules Anywhere extension for Joomla |
Affected:
1.0.0-8.4.1
|
|
| regularlabs.com | ReReplacer extension for Joomla |
Affected:
1.0.0-15.0.3
|
|
| regularlabs.com | Sourcerer extension for Joomla |
Affected:
1.0.0-12.2.8
|
|
| regularlabs.com | Tabs & Accordions Pro extension for Joomla |
Affected:
1.0.0-2.5.6
|
|
| regularlabs.com | Snippets Pro extension for Joomla |
Affected:
1.0.0-9.3.10
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-64792",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T17:37:21.276023Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T17:37:40.918Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Articles Anywhere extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-18.0.2"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Conditional Content extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-6.0.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Modules Anywhere extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-8.4.1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ReReplacer extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-15.0.3"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sourcerer extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-12.2.8"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tabs \u0026 Accordions Pro extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-2.5.6"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Snippets Pro extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-9.3.10"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions - Smart Search indexing could render generated content using the indexing administrator\u2019s identity instead of a public guest. Restricted or administrator-only content could consequently be stored in the public search index and disclosed to visitors."
}
],
"value": "Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions - Smart Search indexing could render generated content using the indexing administrator\u2019s identity instead of a public guest. Restricted or administrator-only content could consequently be stored in the public search index and disclosed to visitors."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-524",
"description": "CWE-524 Use of Cache Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T05:31:54.131Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-64792",
"datePublished": "2026-07-22T20:40:58.877Z",
"dateReserved": "2026-07-20T18:16:31.592Z",
"dateUpdated": "2026-07-28T05:31:54.131Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64791 (GCVE-0-2026-64791)
Vulnerability from nvd – Published: 2026-07-22 20:40 – Updated: 2026-07-28 05:30
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager
Summary
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager - Administrator routes and install/update/uninstall processing did not consistently enforce component-management and installation permissions. An unauthorized backend user or CSRF attack could install, update or remove extensions.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-27 17:36 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | Regular Labs Extension Manager extension for Joomla |
Affected:
1.0.0-9.2.5
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-64791",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T17:36:23.459342Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T17:36:45.924Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Regular Labs Extension Manager extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-9.2.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager - Administrator routes and install/update/uninstall processing did not consistently enforce component-management and installation permissions. An unauthorized backend user or CSRF attack could install, update or remove extensions."
}
],
"value": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager - Administrator routes and install/update/uninstall processing did not consistently enforce component-management and installation permissions. An unauthorized backend user or CSRF attack could install, update or remove extensions."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T05:30:57.646Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-64791",
"datePublished": "2026-07-22T20:40:15.641Z",
"dateReserved": "2026-07-20T18:16:31.592Z",
"dateUpdated": "2026-07-28T05:30:57.646Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63685 (GCVE-0-2026-63685)
Vulnerability from nvd – Published: 2026-07-22 20:43 – Updated: 2026-07-28 05:34
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension
Summary
Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension - Administrator routes and replacement requests did not consistently require Super User permission and a valid token. An unauthorized backend user or CSRF attack could perform database replacements, potentially causing major data corruption or site compromise.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-27 18:40 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | DB Replacer extension for Joomla |
Affected:
1.0.0-8.2.7
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-63685",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T18:40:38.416986Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T18:41:09.939Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DB Replacer extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-8.2.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension - Administrator routes and replacement requests did not consistently require Super User permission and a valid token. An unauthorized backend user or CSRF attack could perform database replacements, potentially causing major data corruption or site compromise."
}
],
"value": "Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension - Administrator routes and replacement requests did not consistently require Super User permission and a valid token. An unauthorized backend user or CSRF attack could perform database replacements, potentially causing major data corruption or site compromise."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T05:34:50.869Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-63685",
"datePublished": "2026-07-22T20:43:30.967Z",
"dateReserved": "2026-07-17T15:49:15.531Z",
"dateUpdated": "2026-07-28T05:34:50.869Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63684 (GCVE-0-2026-63684)
Vulnerability from nvd – Published: 2026-07-22 20:39 – Updated: 2026-07-28 05:30
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension
Summary
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension - Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks. Unauthorized backend users or CSRF attacks could expose, create or modify extension configuration and items.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-27 17:35 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | Content Templater extension for Joomla |
Affected:
1.0.0-13.0.0
|
|
| regularlabs.com | ReReplacer extension for Joomla |
Affected:
1.0.0-15.0.3
|
|
| regularlabs.com | Snippets extension for Joomla |
Affected:
1.0.0-9.3.10
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-63684",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T17:35:08.062931Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T17:35:41.716Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Content Templater extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-13.0.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ReReplacer extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-15.0.3"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Snippets extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-9.3.10"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension - Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks. Unauthorized backend users or CSRF attacks could expose, create or modify extension configuration and items."
}
],
"value": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension - Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks. Unauthorized backend users or CSRF attacks could expose, create or modify extension configuration and items."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T05:30:32.698Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-63684",
"datePublished": "2026-07-22T20:39:55.373Z",
"dateReserved": "2026-07-17T15:49:15.531Z",
"dateUpdated": "2026-07-28T05:30:32.698Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63683 (GCVE-0-2026-63683)
Vulnerability from nvd – Published: 2026-07-22 20:42 – Updated: 2026-07-28 05:33
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager
Summary
Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager - IP and GeoIP conditions trusted spoofable forwarded headers, allowing remote clients to bypass location-based rules.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-27 18:44 UTC
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | Advanced Module Manager extension for Joomla |
Affected:
1.0.0-11.0.1
|
|
| regularlabs.com | Conditional Content extension for Joomla |
Affected:
1.0.0-6.0.0
|
|
| regularlabs.com | Content Templater Pro extension for Joomla |
Affected:
1.0.0-13.0.0
|
|
| regularlabs.com | ReReplacer extension Pro for Joomla |
Affected:
1.0.0-15.0.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-63683",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T18:44:30.903088Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T18:44:35.047Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Advanced Module Manager extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-11.0.1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Conditional Content extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-6.0.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Content Templater Pro extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-13.0.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ReReplacer extension Pro for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-15.0.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager - IP and GeoIP conditions trusted spoofable forwarded headers, allowing remote clients to bypass location-based rules."
}
],
"value": "Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager - IP and GeoIP conditions trusted spoofable forwarded headers, allowing remote clients to bypass location-based rules."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T05:33:18.651Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-63683",
"datePublished": "2026-07-22T20:42:06.811Z",
"dateReserved": "2026-07-17T15:49:15.531Z",
"dateUpdated": "2026-07-28T05:33:18.651Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63281 (GCVE-0-2026-63281)
Vulnerability from nvd – Published: 2026-07-22 20:40 – Updated: 2026-07-27 13:28
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager
Summary
Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager - Stored condition values could also execute HTML/JavaScript in administrator summaries.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-27 13:24 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | Advanced Module Manager extension for Joomla |
Affected:
1.0.0-11.0.1
|
|
| regularlabs.com | Conditional Content extension for Joomla |
Affected:
1.0.0-6.0.0
|
|
| regularlabs.com | Content Templater Pro extension for Joomla |
Affected:
1.0.0-13.0.0
|
|
| regularlabs.com | ReReplacer extension Pro for Joomla |
Affected:
1.0.0-15.0.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-63281",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T13:24:01.059457Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T13:24:21.443Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Advanced Module Manager extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-11.0.1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Conditional Content extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-6.0.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Content Templater Pro extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-13.0.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ReReplacer extension Pro for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-15.0.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager - Stored condition values could also execute HTML/JavaScript in administrator summaries."
}
],
"value": "Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager - Stored condition values could also execute HTML/JavaScript in administrator summaries."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T13:28:27.279Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-63281",
"datePublished": "2026-07-22T20:40:29.002Z",
"dateReserved": "2026-07-16T08:19:40.115Z",
"dateUpdated": "2026-07-27T13:28:27.279Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63280 (GCVE-0-2026-63280)
Vulnerability from nvd – Published: 2026-07-22 20:43 – Updated: 2026-07-28 05:34
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager
Summary
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager - Conditions administration did not consistently enforce tokens and component/mapped-item permissions.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-27 18:42 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| regularlabs.com | Advanced Module Manager extension for Joomla |
Affected:
1.0.0-11.0.1
|
|
| regularlabs.com | Conditional Content extension for Joomla |
Affected:
1.0.0-6.0.0
|
|
| regularlabs.com | Content Templater Pro extension for Joomla |
Affected:
1.0.0-13.0.0
|
|
| regularlabs.com | ReReplacer extension Pro for Joomla |
Affected:
1.0.0-15.0.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-63280",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T18:42:17.662043Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T18:42:41.346Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Advanced Module Manager extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-11.0.1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Conditional Content extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-6.0.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Content Templater Pro extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-13.0.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ReReplacer extension Pro for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-15.0.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager - Conditions administration did not consistently enforce tokens and component/mapped-item permissions."
}
],
"value": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager - Conditions administration did not consistently enforce tokens and component/mapped-item permissions."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T05:34:22.469Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-63280",
"datePublished": "2026-07-22T20:43:01.914Z",
"dateReserved": "2026-07-16T08:19:40.115Z",
"dateUpdated": "2026-07-28T05:34:22.469Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63265 (GCVE-0-2026-63265)
Vulnerability from nvd – Published: 2026-07-22 20:44 – Updated: 2026-07-28 05:35
VLAI
EPSS
VEX
Title
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints
Summary
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints - Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-27 18:39 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://regularlabs.com/ | product |
Impacted products
23 products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-63265",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T18:39:24.695155Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T18:39:57.471Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Advanced Module Manager extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-11.0.1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Articles Anywhere extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-18.0.2"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Articles Field extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-4.7.1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Better Frontend Link extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-2.2.5"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cache Cleaner extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-9.7.6"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CDN for Joomla extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-7.3.7"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Conditional Content extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-6.0.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Content Templater extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-13.0.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DB Replacer extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-8.2.7"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Email Protector extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-6.3.7"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Regular Labs Extension Manager extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-9.2.5"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GeoIP extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-6.3.8"
}
]
},
{
"defaultStatus": "unaffected",
"product": "IP Login extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-6.2.5"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Keyboard Shortcuts extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-3.2.5"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Modals extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-15.0.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Modules Anywhere extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-8.4.1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Quick Index extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-4.3.6"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ReReplacer extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-15.0.3"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Snippets extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-9.3.10"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sourcerer extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-12.2.8"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tooltips extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-9.4.7"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Users Anywhere extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-1.2.7"
}
]
},
{
"defaultStatus": "unaffected",
"product": "What? Nothing! extension for Joomla",
"vendor": "regularlabs.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-17.2.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints - Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization."
}
],
"value": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints - Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T05:35:26.645Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://regularlabs.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-63265",
"datePublished": "2026-07-22T20:44:05.164Z",
"dateReserved": "2026-07-16T05:24:31.924Z",
"dateUpdated": "2026-07-28T05:35:26.645Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}