https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 22:47:20 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-90905 <p>Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=com_easystore&amp;task=appconfig.updateConfiguration updated core Joomla mail configuration (fromname, mailfrom) in configuration.php without verifying anti-CSRF tokens or checking for administrative permissions (canAdmin). A malicious site could silently modify the site&#39;s sender name and email address via forged requests from an admin&#39;s browser. Resolved by enforcing Session::checkToken(&#39;request&#39;) / Session::checkToken(&#39;post&#39;) and adding explicit administrative authorization verification via AccessControl::create()-&gt;canAdmin().</p> <p>Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=com_easystore&amp;task=appconfig.updateConfiguration updated core Joomla mail configuration (fromname, mailfrom) in configuration.php without verifying anti-CSRF tokens or checking for administrative permissions (canAdmin). A malicious site could silently modify the site&#39;s sender name and email address via forged requests from an admin&#39;s browser. Resolved by enforcing Session::checkToken(&#39;request&#39;) / Session::checkToken(&#39;post&#39;) and adding explicit administrative authorization verification via AccessControl::create()-&gt;canAdmin().</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-90905 https://vulnerability.circl.lu/vuln/ghsa-3x8p-4xmj-7ppp <p>Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=com_easystore&amp;task=appconfig.updateConfiguration updated core Joomla mail configuration (fromname, mailfrom) in configuration.php without verifying anti-CSRF tokens or checking for administrative permissions (canAdmin). A malicious site could silently modify the site&#39;s sender name and email address via forged requests from an admin&#39;s browser. Resolved by enforcing Session::checkToken(&#39;request&#39;) / Session::checkToken(&#39;post&#39;) and adding explicit administrative authorization verification via AccessControl::create()-&gt;canAdmin().</p> <p>Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=com_easystore&amp;task=appconfig.updateConfiguration updated core Joomla mail configuration (fromname, mailfrom) in configuration.php without verifying anti-CSRF tokens or checking for administrative permissions (canAdmin). A malicious site could silently modify the site&#39;s sender name and email address via forged requests from an admin&#39;s browser. Resolved by enforcing Session::checkToken(&#39;request&#39;) / Session::checkToken(&#39;post&#39;) and adding explicit administrative authorization verification via AccessControl::create()-&gt;canAdmin().</p> https://vulnerability.circl.lu/vuln/ghsa-3x8p-4xmj-7ppp