CVE-2026-78085: fallo de gravedad media en joomshaper.com SP Property extension for Joomla
Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.9epss 0.5%
Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked directory confinement checks.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L
Productos afectados
joomshaper.com · SP Property extension for JoomlaCVEs relacionadas — joomshaper.com SP Property extension for Joomla
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-78082CRITICALJoomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4EPSS 0.5%CVE-2026-78302HIGHJoomla Extension - joomshaper.com - Unauthenticated Cross-Site Scripting (XSS) via Unescaped Output in Views and Admin Lists in SP Property < 4.1.4EPSS 0.4%CVE-2026-78303MEDIUMJoomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4EPSS 0.4%CVE-2026-78084MEDIUMJoomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4EPSS 0.3%CVE-2026-78083HIGHJoomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.4EPSS 0.2%