CVE Vulnerability Advisory Database

[Affected Scope] Joomla Balbooa Forms extension versions prior to 2.4.1

[Impact] Unauthenticated attackers can upload arbitrary executable files (such as PHP), leading to full Remote Code Execution (RCE) and complete compromise of the web server

[Mitigation] Immediately upgrade the Balbooa Forms extension to version 2.4.1 or higher, and disable script execution in upload directories

[Affected Scope] Joomla Page Builder CK extension versions prior to 3.6.0

[Impact] Unauthenticated attackers can upload arbitrary executable files (such as PHP), leading to full remote code execution (RCE) and complete compromise of the web server

[Mitigation] Immediately upgrade the Page Builder CK extension to version 3.6.0 or higher

[Affected Scope] Joomla iCagenda extension versions prior to 3.9.15 and 4.0.8

[Impact] Unauthenticated remote attackers can bypass file upload restrictions to upload malicious PHP scripts, leading to complete system compromise via Remote Code Execution (RCE).

[Mitigation] Immediately upgrade the iCagenda extension to the patched versions (3.9.15 / 4.0.8 or higher) and disable script execution in upload directories.

[Affected Scope] Websites utilizing the SP Page Builder extension for Joomla

[Impact] Unauthenticated attackers can upload and execute malicious PHP code, leading to complete takeover of the web server

[Mitigation] Immediately update to the latest patched version, apply WAF rules, and disable PHP execution in upload directories

[Affected Scope] Kentico Xperience through version 13.0.178

[Impact] Authenticated attackers can exploit the Staging Sync Server to upload arbitrary files to relative paths, leading to server-side execution and full Remote Code Execution (RCE)

[Mitigation] Apply the official Kentico hotfix immediately and restrict access to the Staging Sync Server endpoints

[Affected Scope] Samsung MagicINFO 9 Server versions prior to 21.1050

[Impact] Unauthenticated remote attackers can write arbitrary files with SYSTEM authority, potentially leading to Remote Code Execution (RCE).

[Mitigation] Immediately upgrade MagicINFO 9 Server to version 21.1050 or later, and restrict external network access.