CVE-2026-75950mediumCWE-284CWE-639

CVE-2026-75950: falha de média gravidade em cmsjunkie.com J-BusinessDirectory extension…

Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar J-BusinessDirectory extension for Joomla

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.4%
Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3 - Ownership could be changed using attacker-supplied company and user IDs, including for listings that already had an owner. 6.2.3 binds the action to the authenticated user and only allows unowned listings.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
cmsjunkie.com · J-BusinessDirectory extension for Joomla
CVEs relacionadas — cmsjunkie.com J-BusinessDirectory extension…

No mesmo produto, das mais perigosas para as menos.

CVE-2026-75955MEDIUMJoomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory < 6.2.3EPSS 0.4%CVE-2026-75956HIGHJoomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory < 6.2.3EPSS 0.4%CVE-2026-75949CRITICALJoomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3EPSS 0.4%CVE-2026-75953HIGHJoomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3EPSS 0.4%CVE-2026-75951MEDIUMJoomla Extension - cmsjunkie.com - Insecure Direct Object Reference (multiple frontend/API actions) in J-BusinessDirectory < 6.2.3EPSS 0.4%CVE-2026-75954CRITICALJoomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3EPSS 0.4%