SP Page Builder extension for Joomla vulnerabilities
7 known vulnerabilities in SP Page Builder extension for Joomla from Joomshaper.com. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.2 Critical severity
SP Page Builder extension for Joomla: Improper Limitation of a Pathname to a Restricted Directory
Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0 - An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system.
- 8.7 High severity
SP Page Builder extension for Joomla: Improper Neutralization of Input During Web Page Generation
Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a Joomla site's database via a single HTTP request. When an administrator opens the SP
- 9.8 Critical severity
SP Page Builder extension for Joomla: Use of Hard-coded Credentials
Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms.
- 8.3 High severity
SP Page Builder extension for Joomla: Improper Limitation of a Pathname to a Restricted Directory
Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1- Improper path validation and ACL checks lead to a file deletion vector in the media manager.
- 8.2 High severity
SP Page Builder extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of various parameters in the media manager search and date filters lead to an SQL injection vector.
- 9.2 Critical severity
SP Page Builder extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0 - Improper validation of catid parameters in the loadMoreArticles endpoint leads to an SQL injection vector.
- 9.2 Critical severity
SP Page Builder extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of order parameters in the Dynamic Content endpoint leads to an SQL injection vector.