CVE-2026-65430

HighCVSS 7.5

Published: 23/07/2026(UTC)Updated: 27/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

4th percentile - higher than 4% of all known CVEs

Summary

The GeoIP extension for Joomla! leaks MaxMind credentials in request URLs, leading to credential leakage.

Risk Assessment

An attacker can intercept MaxMind credentials, potentially enabling unauthorized access to MaxMind services.

Recommendation

Update the GeoIP extension and ensure credentials are not transmitted in URLs.

Other vulnerabilities in Joomla Extension - GeoIP

See all

CVE-2026-65431Critical
The GeoIP extension for Joomla! extracts database update archives without path validation, leading to a Zipslip vulnerability.
CVE-2026-64875Medium
The GeoIP extension for Joomla! trusts spoofable forwarded client-IP headers, allowing GeoIP rule bypass.

Original NVD description (English source)

Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension - MaxMind credentials where leaked in request URLs, causing a credential leakage vulnerability.