Threat database

Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task `records.custom_action` without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token enforcement. A Guest can supply the numeric ID of any published TF Content task and make the component dispatch its configured executor immediately.

A missing authorization vulnerability exists in the Joomla extension TF Content versions 2.9.0 through 2.9.4. The extension's public RecordController allows unauthenticated users to create and edit records without proper permission checks. Attackers can use a valid token from Joomla's public login form to modify any TF Content record, including sensitive fields such as published status, access level, and creator ID.