https://cvebrief.com/archive/cves/vendor/joomshaper-com/ High and critical joomshaper.com vulnerabilities covered by CVE Brief, with independent analyst commentary. en-us Tue, 15 Sep 2026 12:00:00 GMT https://cvebrief.com/cve/cve-2026-78375/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-joomshaper-com-CVE-2026-78375 Tue, 15 Sep 2026 12:00:00 GMT Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0 - plgContentSppagebuilder::onContentAfterSave() read jform[attribs][sppagebuilder_article_id] from the request and concatenated it dire Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-78082/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-joomshaper-com-CVE-2026-78082 Fri, 11 Sep 2026 12:00:00 GMT An unauthenticated SQL injection vulnerability in the SP Property extension for Joomla allows remote attackers to extract sensitive database information via unsanitized query parameters. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-78302/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-joomshaper-com-CVE-2026-78302 Fri, 11 Sep 2026 12:00:00 GMT Joomla Extension - joomshaper.com - Unauthenticated Stored Cross-Site Scripting (XSS) via Unescaped Output in Views and Admin Lists in SP Property < 4.1.4 - Multiple template files across frontend views and administrator list tables rendered attributes and text values directly in Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-78077/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-joomshaper-com-CVE-2026-78077 Tue, 01 Sep 2026 12:00:00 GMT Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.10 - Unsanitized column and item configuration values stored within the MegaMenu layout JSON were rendered without complete contextual escapin Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-78078/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-joomshaper-com-CVE-2026-78078 Tue, 01 Sep 2026 12:00:00 GMT Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10 - Image uploads previously validated only file extension and basic size parameters. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-66494/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-joomshaper-com-CVE-2026-66494 Sat, 08 Aug 2026 12:00:00 GMT Joomla Extension - joomshaper Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-65766/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-joomshaper-com-CVE-2026-65766 Tue, 28 Jul 2026 12:00:00 GMT The SP Page Builder extension for Joomla contains an unauthenticated SQL injection vulnerability in the Dynamic Content endpoint due to improper validation of order parameters. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-65876/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-joomshaper-com-CVE-2026-65876 Tue, 28 Jul 2026 12:00:00 GMT The SP Page Builder extension for Joomla contains an unauthenticated SQL injection vulnerability in the loadMoreArticles endpoint due to improper validation of catid parameters. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-65877/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-joomshaper-com-CVE-2026-65877 Tue, 28 Jul 2026 12:00:00 GMT Joomla Extension - joomshaper Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-65878/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-joomshaper-com-CVE-2026-65878 Tue, 28 Jul 2026 12:00:00 GMT Joomla Extension - joomshaper Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-65759/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-joomshaper-com-CVE-2026-65759 Fri, 24 Jul 2026 12:00:00 GMT Joomla Extension - joomshaper Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-65761/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-joomshaper-com-CVE-2026-65761 Fri, 24 Jul 2026 12:00:00 GMT The Easy Store extension for Joomla is vulnerable to an unauthenticated SQL injection, allowing remote attackers to access database credentials and session data. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-57829/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-joomshaper-com-CVE-2026-57829 Mon, 13 Jul 2026 12:00:00 GMT The Joomla extension Helix Ultimate is vulnerable to an unauthenticated stored XSS Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-57830/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-joomshaper-com-CVE-2026-57830 Mon, 13 Jul 2026 12:00:00 GMT The Joomla extension Helix Ultimate is vulnerable to an unauthenticated arbitrary file deletion Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-49049/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-joomshaper-com-CVE-2026-49049 Tue, 30 Jun 2026 12:00:00 GMT The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters Independent analyst report on CVE Brief.