Known Vulnerabilities for products from Joomlaworks
Listed below are 10 of the newest known vulnerabilities associated with the vendor "Joomlaworks".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-48946 json | The K2 frontend article-attachment upload path accepts files whose extension is `.php`, and Apache's standard mod_php matches... | Not Provided | 2026-06-25 | 2026-06-28 |
| CVE-2026-48945 json | The K2 article gallery upload path accepts a zip/tar archive, extracts it under `/media/k2/galleries/ |
Not Provided | 2026-06-25 | 2026-06-28 |
| CVE-2026-48944 json | The K2 frontend article-save handler accepts an `attachment[N][existing]` POST field that is concatenated with `JPATH_SITE/` ... | Not Provided | 2026-06-25 | 2026-06-28 |
| CVE-2026-48943 json | K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`. A Registered Joomla user, by includ... | Not Provided | 2026-06-25 | 2026-06-28 |
| CVE-2026-48942 json | K2 ≤ 2.26 renders the `#__k2_users.image` column directly into HTML `src` attributes via two distinct templates, in both ca... | Not Provided | 2026-06-25 | 2026-06-28 |
| CVE-2026-48941 json | The K2 frontend `item.checkin` task accepts an unauthenticated `sigProFolder` query parameter and uses it directly to address... | Not Provided | 2026-06-25 | 2026-06-28 |
| CVE-2026-48940 json | A Joomla user with K2 "create item" rights (Author tier by default) can submit an article whose `embedVideo` POST field conta... | Not Provided | 2026-06-25 | 2026-06-28 |
| CVE-2018-7482 json | ** DISPUTED ** The K2 component 2.8.0 for Joomla! has Incorrect Access Control with directory traversal, allowing an attacker... | 7.5 - HIGH | 2018-02-28 | 2023-11-07 |
| CVE-2010-0696 json | Directory traversal vulnerability in includes/download.php in the JoomlaWorks AllVideos (Jw_allVideos) plugin 3.0 through 3.2... | Not Provided | 2010-02-23 | 2026-04-29 |
| CVE-2009-2395 json | SQL injection vulnerability in the K2 (com_k2) component 1.0.1 Beta and earlier for Joomla! allows remote attackers to execut... | Not Provided | 2009-07-09 | 2026-04-23 |