CVE Catalog
CVE-2026-61424
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk0.26%
18th percentile - higher than 18% of all known CVEs
Summary
The Joomla extension DJ-Classifieds versions below 3.11.2 is vulnerable to unauthenticated arbitrary file upload. An attacker without authentication can upload any file, leading to full remote code execution (RCE).
Risk Assessment
Lack of authentication allows an attacker to fully compromise the server, steal data, or install a backdoor without any restrictions.
Recommendation
Update the DJ-Classifieds extension to version 3.11.2 or later. Implement authentication mechanisms and file upload validation.
Original NVD description (English source)
Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated file upload, leading to full RCE.