Vulnerabilities

TI-2026-63953 CVE-2026-97161 · GHSA-4qjx-g3m9-jcwf

Path traversal in lomart.fr UP plugin for Joomla

MEDIUM 46

Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00422 Published 2026-09-26 No fix listed CWE-22

TI-2026-63955 CVE-2026-97163 · GHSA-6pgc-8534-jjrf

MEDIUM 49

Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00466 Published 2026-09-26 No fix listed CWE-22

TI-2026-63954 CVE-2026-97162 · GHSA-7xvw-34f4-v8v2

LOW 36

Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00328 Published 2026-09-26 No fix listed CWE-89

TI-2026-63952 CVE-2026-97160 · GHSA-4h74-hj22-v78v

MEDIUM 45

Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.0131 Published 2026-09-26 No fix listed CWE-94