CVE-2025-7721criticalexploração observadaCWE-98

CVE-2025-7721: falha crítica em beardev JoomSport – for Sports: Team & League…

JoomSport <= 5.7.3 - Unauthenticated Directory Traversal to Local File Inclusion

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar JoomSport – for Sports: Team & League, Football, Hockey & more

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

50Vexday Risk Score

Priorize a correção. Ela exploração observada pelo VulnCheck.

ssvc Actcvss 9.8epss 0.7%
da publicação à arma
Publicada no NVD3 de out.
VulnCheck+375d
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.7.3 via the task parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
beardev · JoomSport – for Sports: Team & League, Football, Hockey & more
CVEs relacionadas — beardev JoomSport – for Sports: Team & League…

No mesmo produto, das mais perigosas para as menos.

CVE-2022-2718HIGHJoomSport – for Sports: Team & League, Football, Hockey & more <= 5.2.5 - Authenticated (Admin+) SQL Injection via orderbyEPSS 1.5%CVE-2022-2717HIGHJoomSport – for Sports: Team & League, Football, Hockey & more <= 5.2.5 - Authentciated (Admin+) SQL Injection via orderbyEPSS 1.5%CVE-2026-11920MEDIUMJoomSport <= 5.7.9 - Authenticated (Administrator+) SQL Injection via 'order' ParameterEPSS 0.5%CVE-2026-118192MEDIUMJoomSport <= 5.7.11 - Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode AttributeEPSS 0.4%CVE-2026-12133MEDIUMJoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Deletion via season_groupdel AJAX actionEPSS 0.4%CVE-2026-13010MEDIUMJoomSport <= 5.7.9 - Authenticated (Contributor+) SQL Injection via 'event' Shortcode AttributeEPSS 0.4%