Cmsjunkie.com vulnerabilities
We track 4 vulnerabilities in Cmsjunkie.com products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on August 19, 2026.
Latest Cmsjunkie.com vulnerabilities
- 8.7 High severity
J-BusinessDirectory extension for Joomla: Allocation of Resources Without Limits or Throttling
Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory < 6.2.3 - Pagination values were not strictly typed. Array/non-numeric values (for example limitstart[]) could trigger PHP type errors in arithmetic, and limi
- 9.3 Critical severity
J-BusinessDirectory extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3 - Search keywords and ORDER BY were concatenated into SQL. 6.2.3 quotes keywords and allow-lists the sort clause.
- 7.5 High severity
J-BusinessDirectory extension for Joomla: Insertion of Sensitive Information Into Sent Data
Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3 - Recipient address was taken from the request (contact_id_offer / contact_id_event) instead of the server-side offer/event record, so mail could be sent to an arbitrary address.
- 10.0 Critical severity
J-BusinessDirectory extension for Joomla: Unrestricted Upload of File with Dangerous Type
Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3 - Upload/remove accepted a client-controlled root (_path_type could point at the component site/admin trees), did not enforce path containment,