TI-2026-83930 Aliases CVE-2026-105604 GHSA-g3qw-rp5c-h7mm

Unauthenticated SQL injection in DJ-Classifieds Joomla extension

MEDIUM 48CWE-89Published 2026-11-02 · Updated 2026-11-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

The DJ-Classifieds extension for Joomla before 3.11.3 is affected. The frontend search does not neutralize special SQL elements, which is classified as CWE-89. An unauthenticated remote attacker can inject SQL commands through the search and gain high impact on the confidentiality, integrity and availability of the database.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated SQL injection vector in the frontend search.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0035 28th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
dj-extensions.com	DJ-Classifieds extension for Joomla	1.0-3.11.2	—	No fix listed	CNA

DJ-Classifieds extension for Joomla Vendordj-extensions.com Affected 1.0-3.11.2 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for DJ-Classifieds extension for Joomla.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Timeline

2026-11-02 Threatist record created from CVE-2026-105604
2026-11-02 CISA SSVC decision points changed
2026-11-02 Alias added: GHSA-g3qw-rp5c-h7mm

References

Other 1

https://dj-extensions.com/dj-classifieds

TI-2026-44289 Unrestricted file upload in dj-extensions.com jDownloads extension for Joomla CVSS 4.0CRITICAL 10.0
TI-2026-44029 Unrestricted file upload in dj-extensions.com DJ-Classifieds extension for Joomla CVSS 4.0CRITICAL 10.0
TI-2026-81122 Stored cross-site scripting in DJ-HelpfulArticles Joomla extension CVSS 4.0HIGH 8.7
TI-2025-32030 Extension - dj-extensions.com - SQLi vulnerability in DJ-Flyer component 1.0-3.2 for Joomla CVSS 4.0HIGH 8.5
TI-2026-83929 Arbitrary file upload in Joomla extension DJ-Classifieds CVSS 4.0CRITICAL 9.4
TI-2025-34271 Extension - dj-extensions.com - SQLi vulnerability in DJ-Classifieds component 3.9.2-3.10.1 for Joomla CVSS 4.0HIGH 8.5

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences