Quix Page Builder vulnerabilities

The Joomla extension Quix Page Builder Pro before version 6.2.1 discloses information by returning raw exceptions in AJAX handler responses. This vulnerability allows technical data leakage.

Broken access control vulnerability in Joomla extension Quix Page Builder before version 6.2.1. Authenticated users can upload media files regardless of their media management permissions.

The Joomla extension Quix Page Builder Pro before version 6.2.1 contains an authenticated stored XSS vulnerability. Authenticated users can inject malicious code into id/class fields that are rendered for public users.

Authenticated Stored XSS vulnerability in Quix Page Builder for Joomla (versions < 6.2.1). An authenticated builder user can inject scripts that execute for any visitor, due to unescaped output and unsanitized SVG.

Path traversal and file read vulnerability in Quix Page Builder for Joomla (versions < 6.2.1). Unauthenticated users can exploit form elements to read arbitrary files on the server.