Threat database

Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0 - The page a shared image link opens (the share mini page of the front end) can link the article the image was shared from when the option "Share article links" is on. It took the address of the article from the shared link and printed it into the page without checking or escaping it; with the link type "Image Page with Redirect" it followed the address at once. A prepared link could therefore run a script in the page, in the session of the visitor who opened it, or send the visitor to another web site. Nothing on the server is changed or read by the server.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Event Gallery extension for Joomla versions up to 6.6.0. This flaw allows an attacker to perform certain backend list tasks without proper form token validation, potentially changing settings such as payment method, shipping method, image type, order status, watermark, event shop status, main image selection, and image sorting. The vulnerability does not allow deletion or reading of data, nor does it affect orders.

Phoca Cart extension for Joomla versions 5.0.0 through 6.1.8 contains an authorization bypass vulnerability. The order-file download endpoint does not properly verify download and order tokens, allowing any remote user, including unauthenticated guests, to download digital goods belonging to other customers by enumerating order IDs and supplying arbitrary non-empty tokens.

An unauthenticated SQL injection vulnerability exists in OrdaSoft Joomla CCK versions up to and including 8.3.15. The flaw arises because the order column for records is user-controlled and not properly validated, allowing attackers to inject malicious SQL commands. This vulnerability has a critical severity rating with a CVSS score of 9.3.

A reflected cross-site scripting (XSS) vulnerability exists in the Dynamic Content Filter addon of the SP Page Builder Pro extension for Joomla. The issue occurs because slider minimum and maximum values are taken from a request parameter, HTML-escaped in an attribute but then echoed without escaping as text content, allowing an unauthenticated attacker to inject arbitrary HTML or JavaScript. The vulnerability affects versions 3.0.0 through 5.6.1p2 of the extension.

A code injection vulnerability exists in the image processing library used by Ghost for SVG handling. This flaw allows any staff user, including Contributors, to create a bookmark card for a malicious website, which can lead to arbitrary command execution on the Ghost server. The vulnerability affects Ghost versions from 6.56.0 up to but not including 6.67.0. A fix is available in version 6.67.0.

CVE-2026-105386 is a SQL injection vulnerability in the onetwothreeneth HospitalManagementSystem affecting the get function in print.php via the transaction_id parameter. The vulnerability allows remote attackers to inject SQL commands. The product uses a rolling release model, so no specific affected or fixed versions are identified. The issue was reported early but remains unaddressed. The CVSS 4.0 score is 6.9, indicating medium severity.

CVE-2026-58880 is a high-severity elevation of privilege vulnerability in Google Android affecting versions 16, 16-qpr2, and 17. It arises from a race condition in the handle_app_val_response function of the btif_rc.cc component. Exploitation does not require user interaction and can lead to local code execution with elevated privileges.

CVE-2026-58865 is a denial of service vulnerability in multiple functions of PduParser.java in Google Android. It results from a missing bounds check that allows remote attackers to cause persistent denial of service without user interaction or privileges. The vulnerability affects Android versions 14 through 17 and 16-qpr2. No official patch information is provided.

CVE-2026-58859 is a high severity denial of service vulnerability in Google Android version 17. It arises from uncaught exceptions in multiple locations, potentially allowing local privilege escalation without requiring user interaction.

CVE-2026-58856 is a low-severity elevation of privilege vulnerability in Google Android affecting versions 14, 15, 16, 16-qpr2, and 17. It arises from a missing bounds check in the DeprecatedCamera3StreamSplitter.cpp component, leading to a possible out-of-bounds read. Exploitation does not require user interaction and does not grant additional execution privileges but may disclose local information.

CVE-2026-58854 is a high-severity elevation of privilege vulnerability in Google Android affecting versions 14, 15, 16, 16-qpr2, and 17. The flaw involves possible memory corruption due to type confusion in multiple locations, allowing local attackers to escalate privileges without needing additional execution rights or user interaction.

CVE-2026-58841 is a high-severity elevation of privilege vulnerability in Google Android affecting versions 14 through 17. It arises from a logic error in multiple functions of VirtualAudioControllerTest.java, allowing a local attacker to bypass permissions and escalate privileges without requiring user interaction.

CVE-2026-58835 is a high-severity elevation of privilege vulnerability in Google Android affecting versions 16, 16-qpr2, and 17. It involves a heap buffer overflow in the cfg2prop function of btif_storage.cc, which can cause an out-of-bounds write. Exploitation does not require user interaction and could lead to remote code execution with elevated privileges.

CVE-2026-58834 is a medium severity vulnerability in Google Android affecting versions 14, 15, 16, 16-qpr2, and 17. It involves improper input validation in the setPermissionGrantState function of DevicePolicyManagerService.java, which can cause a persistent local denial of service without requiring user interaction or additional privileges.

CVE-2026-58815 is a high-severity elevation of privilege vulnerability in Google Android affecting versions 14, 15, 16, 16-qpr2, and 17. It involves a possible out-of-bounds write due to incorrect bounds checking in multiple locations. Exploitation does not require user interaction or additional execution privileges.

CVE-2026-55286 is a high-severity elevation of privilege vulnerability in Google Android version 17. It arises from an out-of-bounds write in the stpropnci_process function due to an incorrect bounds check. Exploitation does not require user interaction or additional execution privileges.

CVE-2026-55280 is a high-severity elevation of privilege vulnerability in Google Android versions 16, 16-qpr2, and 17. It involves a possible out-of-bounds write caused by uninitialized data in multiple locations. Exploitation does not require user interaction or additional execution privileges.

CVE-2026-55270 is a high-severity elevation of privilege vulnerability in Google Android affecting versions 14, 15, 16, 16-qpr2, and 17. The flaw exists in the dialInternal component where a permission bypass occurs due to a confused deputy issue. Exploitation does not require user interaction or additional execution privileges, enabling local attackers to escalate privileges.

CVE-2026-55269 is a high-severity elevation of privilege vulnerability in Google Android affecting versions 16, 16-qpr2, and 17. It arises from improper input validation in the FilterCapturedPacket function of snoop_logger.cc, leading to a possible memory safety issue. Exploitation does not require user interaction or additional execution privileges.