CVE-2026-97163

CriticalCVSS 9.8/10Last modified Oct 20, 2026

Description

Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Sep 26, 2026
Last modified
Oct 20, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-971647.0Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in Event Gallery extension < 6.5.0 - Using thCVE-2026-971655.3Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0 - The “return” parameter is base64-decCVE-2026-97177.2CWE-78 Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could allow unauthorized CVE-2026-971764.2A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occCVE-2026-971776.6A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system faCVE-2026-971794.3A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. This vulnerability affects the function list of the file o2server/x_bCVE-2026-97186.5CWE-617 Reachable Assertion vulnerability exists that could allow an authenticated attacker to trigger a denial-of-service condition, impactCVE-2026-971815.3GPM LIGHT developed by ezGlobal has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can directly access system logCVE-2026-971827.3A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/srcCVE-2026-971834.3The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticateCVE-2026-971857.8A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indiCVE-2026-971888.8The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row save
CVE-2026-97163: Critical severity, CVSS 9.8 | Vulnix