CVE-2026-65761— Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1
Possible ATT&CK Techniques 3AI
T1078 · Valid Accounts T1530 · Data from Cloud Storage T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| joomshaper.com | Easy Store extension for Joomla | 1.0.0-2.0.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-65761
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1
Source: CVE Program / CVE List V5
Vulnerability Description
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including credentials and sessions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| joomshaper.com | Easy Store extension for Joomla | 1.0.0-2.0.1 | - |
II. Public POCs for CVE-2026-65761
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-65761
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-65761 (1)
- 🔗 EasyStore Joomla Security Vulnerabilities | mySites.guruthird-party-advisory
Same Patch Batch · joomshaper.com · 2026-07-23 · 3 CVEs total
| CVE-2026-65760 | 9.2 CRITICAL | Joomla Extension - joomshaper.com - cross-customer order and personal information disclosu |
| CVE-2026-65759 | 8.7 HIGH | Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store ex |
IV. Related Vulnerabilities
Same vendor: joomshaper.com
- CVE-2026-65759
Joomla Extension - joomshaper.com - unauthenticated payment/ - CVE-2026-65760
Joomla Extension - joomshaper.com - cross-customer order and - CVE-2026-57830
Joomla Extension - joomshaper.com - Unauthenticated arbitrar - CVE-2026-57829
Joomla Extension - joomshaper.com - Unauthenticated stored X - CVE-2026-49049
Joomla Extension - joomshaper.com - Unauthenticated access t
Same weakness: CWE-89
- CVE-2026-15663
Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL I - CVE-2026-16765
CodeAstro Online Classroom loginlinkadmin.php sql injection - CVE-2026-63359
Appriss Insights VINE SQLI - CVE-2026-65532
WordPress Persian Woocommerce SMS plugin <= 7.2.2 - SQL Inje - CVE-2026-65526
WordPress Visualizer plugin <= 4.0.6 - SQL Injection vulnera
V. Comments for CVE-2026-65761
No comments yet