Threat database

Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.

CVE-2026-77997 is a medium severity vulnerability in the YOOtheme Pro extension for Joomla versions 1.0.0 through 5.0.41. It involves improper access control where users with com_template editing permissions can access information about arbitrary modules without having the necessary com_modules permissions. This could lead to unauthorized disclosure of privileged information.

CVE-2026-77996 is a high-severity stored cross-site scripting (XSS) vulnerability in the YOOtheme Pro extension for Joomla. It affects versions 1.0.0 through 5.0.41. The flaw arises from improper escaping of input in the location custom field, allowing authenticated privileged users to inject malicious scripts. This vulnerability does not require user interaction and has a high impact on confidentiality and integrity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2026-76612 is a high severity stored cross-site scripting (XSS) vulnerability in the yootheme.com Zoo extension for Joomla. It affects versions up to and including 4.1.65. The flaw arises because user-supplied input in comments and user-controlled fields was not properly escaped, allowing unauthenticated attackers to inject malicious scripts that are stored and executed when viewed.

CVE-2026-76611 is a medium severity vulnerability in the yootheme.com Zoo extension for Joomla versions 1.0.0 through 4.1.65. It allows unauthenticated attackers to perform arbitrary directory listing via the Gallery element due to improper limitation of a pathname to a restricted directory (CWE-22). This could expose directory contents without requiring authentication.

CVE-2026-75115 is a high severity path traversal vulnerability in the YOOtheme Pro extension for Joomla versions 2.3.0 through 5.0.40. It allows authenticated privileged users to read arbitrary files on the filesystem due to improper limitation of pathname filtering in the Filesystem source component. This vulnerability arises from glob-based pattern filtering that can be bypassed to access restricted files.

An authenticated SQL injection vulnerability exists in the YOOtheme Pro extension for Joomla versions 1.0.0 through 5.0.40. This flaw allows any user with contributor-level privileges to inject arbitrary content into SQL queries, potentially compromising the database integrity. The vulnerability is classified as high severity with a CVSS score of 8.6.

A reflected cross-site scripting (XSS) and open redirect vulnerability exists in the Zoo extension for Joomla versions 1.0.0 through 4.1.65. The issue arises from improper neutralization of input in the submission redirect parameter. This vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the yootheme.com Zoo extension for Joomla versions 1.0.0 through 4.1.65. The issue is due to missing CSRF tokens on front-end state-changing actions, allowing an attacker with high privileges to potentially trick a user into performing unintended actions. The vulnerability has a medium severity score of 4.6.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the yootheme.com Zoo extension for Joomla versions 1.0.0 through 4.1.64. The issue arises because the comment controller endpoint does not enforce Access Control List (ACL) checks, allowing unauthenticated users to modify tags without authorization. This vulnerability has a medium severity rating with a CVSS score of 6.9.

An unauthenticated arbitrary file upload vulnerability exists in the Zoo extension for Joomla by yootheme.com, versions 1.0.0 through 4.1.63. The vulnerability arises because the image element accepts arbitrary files when the client-supplied Content-Type is within the image MIME group. This can allow attackers to upload dangerous files without authentication.

An open redirect vulnerability (CWE-601) exists in the yootheme.com Zoo extension for Joomla versions 1.0.0 through 4.1.63. The vulnerability occurs in the CommentController::twitterAuthenticate() function where the referer request parameter is passed directly to setRedirect() without validation, allowing redirection to untrusted sites. This issue has a medium severity with a CVSS score of 5.1.

An unauthenticated SQL injection vulnerability exists in the yootheme.com Zoo extension for Joomla versions 1.0.0 through 4.1.63. The flaw occurs in the ItemController::element() method where the filter_type request parameter is directly interpolated into an SQL query without proper quoting or escaping, allowing attackers to manipulate the query structure.