Skip to content
OpenAdvisories

Vendor

joomshaper.com

42 known vulnerabilities.

Products

Easy Store extension for Joomla 10 Helix Ultimate extension for Joomla 9 SP Page Builder extension for Joomla 9 SP Property extension for Joomla 6 SP Page Builder (Free and Pro) extension for Joomla 4 SP Page Builder (Pro) extension for Joomla 3 Helix3 extension for Joomla 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-78082

    Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4

    Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4 - The property search and listing query builders assembled several WHERE and ORDER BY clauses (zipcode, sorting, price_range_dropdown…

    joomshaper.com SP Property extension for Joomla Web / CMS
  • Critical 9.2
    CVE-2026-67285

    Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0

    Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0 - An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system.

    joomshaper.com SP Page Builder extension for Joomla Web / CMS
  • Critical 9.2
    CVE-2026-65876

    Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0

    Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0 - Improper validation of catid parameters in the loadMoreArticles endpoint leads to an SQL injection vector.

    joomshaper.com SP Page Builder extension for Joomla Web / CMS
  • Critical 9.8
    CVE-2026-65879

    Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1

    Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms.

    joomshaper.com SP Page Builder extension for Joomla Web / CMS
  • Critical 9.2
    CVE-2026-65766

    Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1

    Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of order parameters in the Dynamic Content endpoint leads to an SQL injection vector.

    joomshaper.com SP Page Builder extension for Joomla Web / CMS
  • Critical 9.3
    CVE-2026-65761 Public exploit Scanner template

    Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1

    Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including credentials and sessi…

    joomshaper.com Easy Store extension for Joomla Web / CMS
  • Critical 9.2
    CVE-2026-65760

    Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1

    Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system.

    joomshaper.com Easy Store extension for Joomla Web / CMS