Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

13 records

Vendor: yootheme.com Clear all filters
TI-2026-79272 CVE-2026-102785 · GHSA-8w8j-f6ph-29mm

Unrestricted upload in YOOtheme Pro for Joomla allows code execution

Priority MEDIUM 50

Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and th…

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00772 Published 2026-10-22 No fix listed CWE-434
TI-2026-54272 CVE-2026-77997 · GHSA-84hx-8vrm-hqm7

Improper access control in yootheme.com YOOtheme Pro extension for Joomla

Priority LOW 23

Joomla Extension - yootheme.com - Authenticated, privileged information disclosure in YOOtheme Pro 1.0.0-5.0.41 - A missing access check allowed users with com_template editing permissions to access information about arb…

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00388 Published 2026-08-25 No fix listed CWE-284
TI-2026-54271 CVE-2026-77996 · GHSA-px6v-5f2p-p6xr

Cross-site scripting in yootheme.com YOOtheme Pro extension for Joomla

Priority LOW 35

Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector.

CVSS 4.0HIGH 7.5 Network High privileges No interaction EPSS 0.00418 Published 2026-08-25 No fix listed CWE-79
TI-2026-53544 CVE-2026-76612 · GHSA-6f22-4hxh-xrqh

Cross-site scripting in yootheme.com Zoo extension for Joomla

Priority MEDIUM 40

Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00436 Published 2026-08-21 No fix listed CWE-79
TI-2026-53543 CVE-2026-76611 · GHSA-j32c-fpr2-v6gm

Path traversal in yootheme.com Zoo extension for Joomla

Priority LOW 37

Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00496 Published 2026-08-21 No fix listed CWE-22
TI-2026-52777 CVE-2026-75115 · GHSA-42xr-8p7f-gqh6

Path traversal in yootheme.com YOOtheme Pro extension for Joomla

Priority LOW 31

Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to…

CVSS 4.0HIGH 7.0 Network High privileges No interaction EPSS 0.00468 Published 2026-08-21 No fix listed CWE-22
TI-2026-53545 CVE-2026-76613 · GHSA-vmfm-wc5f-55m2

SQL injection in yootheme.com YOOtheme Pro extension for Joomla

Priority LOW 39

Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00369 Published 2026-08-21 No fix listed CWE-89
TI-2026-53542 CVE-2026-76610 · GHSA-5qx9-5vj6-wf25

Improper access control in yootheme.com Zoo extension for Joomla

Priority LOW 36

Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00221 Published 2026-08-20 No fix listed CWE-284
TI-2026-52567 CVE-2026-74803 · GHSA-c2jh-c375-pjcv

Unrestricted file upload in yootheme.com Zoo extension for Joomla

Priority MEDIUM 49

Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00428 Published 2026-08-19 No fix listed CWE-434
TI-2026-52776 CVE-2026-75114 · GHSA-5w5r-gpcr-x5pw

Open redirect in yootheme.com Zoo extension for Joomla

Priority LOW 23

Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64 - The referer request parameter is passed straight to setRedirect() with no validation.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00406 Published 2026-08-19 No fix listed CWE-601
TI-2026-52568 CVE-2026-74804 · GHSA-v9gw-jh22-6wqh

Joomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.64

Priority MEDIUM 48

Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64 - The filter_type request value is interpolated into the query as a.type = "..." and the type_filter array as a…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00386 Published 2026-08-19 No fix listed CWE-89