CVE-2026-21625

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

User provided uploads to the Easy Discuss component for Joomla aren't properly validated. Uploads are purely checked by file extensions, no mime type checks are happening.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
Stackideas.comEasyDiscuss extension for Joomla1.0.0-5.0.15

References

Timeline

Published
Jan 16, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-216267.5Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an informatCVE-2026-216279.5The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under CVE-2026-216289.8A improperly secured file management feature allows uploads of dangerous data types for unauthenticated users, leading to remote code executCVE-2026-216297.3The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected bCVE-2026-21637.2A vulnerability was identified in D-Link DIR-600 up to 2.15WWb02. This vulnerability affects unknown code of the file ssdp.cgi. Such manipulCVE-2026-216308.8Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.CVE-2026-216315.4Lack of output escaping leads to a XSS vector in the multilingual associations component.CVE-2026-216325.4Lack of output escaping for article titles leads to XSS vectors in various locations.CVE-2026-216338.8A malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi Protect Camera by exploiting a discovery pCVE-2026-216346.5A malicious actor with access to the adjacent network could overflow the UniFi Protect Application (Version 6.1.79 and earlier) discovery prCVE-2026-216356.5An Improper Access Control could allow a malicious actor in Wi-Fi range to the EV Station Lite (v1.5.2 and earlier) to use WiFi AutoLink feaCVE-2026-2163610.0A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabl