Threat database

CVE-2026-97163 is a critical vulnerability in the lomart.fr UP plugin for Joomla affecting versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29. It involves improper limitation of a pathname to a restricted directory (CWE-22), allowing unauthenticated remote code installation. The vulnerability has a CVSS 4.0 base score of 10.0, indicating it is exploitable over the network without authentication and can lead to severe impact. No patch or remediation information is currently available from the vendor.

The UP plugin for Joomla by lomart.fr contains multiple SQL injection vulnerabilities in versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29. These vulnerabilities allow attackers to improperly neutralize special elements in SQL commands, potentially enabling manipulation of database queries. The issue is classified under CWE-89 and has a high severity rating with a CVSS score of 8.3.

A critical path traversal vulnerability (CWE-22) exists in the lomart.fr UP plugin for Joomla, affecting versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29. This vulnerability allows unauthorized access to restricted directories and files by improperly limiting pathname inputs. It has a high CVSS 4.0 score of 9.2, indicating it is network exploitable without requiring privileges or user interaction, with a high impact on confidentiality and security controls. No official patch or remediation guidance is currently available.

CVE-2026-97160 is a critical code injection vulnerability in the lomart.fr UP plugin for Joomla. It allows authenticated users with high privileges to inject and execute arbitrary PHP code. The flaw affects versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29 of the plugin. The vulnerability is classified as CWE-94 and has a CVSS 4.0 score of 9.4, indicating a severe security risk.