CVE-2026-76611

Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64. The filter_type request value is interpolated into the query as a.type = "..." and the type_filter array as a.type IN ("..."), with no quoting or escaping.

Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64. The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group.

The Joomla extension Zoo (from yootheme.com) before version 4.1.66 has a reflected XSS and open redirect vulnerability via the submission redirect parameter.

Joomla Extension - yootheme.com - Zoo prior to version 4.1.66 has unauthenticated stored XSS. User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector.

The Joomla extension Zoo (from yootheme.com) before version 4.1.66 has missing CSRF tokens on front-end state changes, enabling CSRF attacks.

In the Zoo extension for Joomla (versions < 4.1.65), the comment controller endpoint lacks ACL checks, allowing unauthenticated users to modify tags without authorization.

Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64 - The referer request parameter is passed straight to setRedirect() with no validation.