Each flaw with its affected versions, the safe release and a step-by-step guide. The vendor’s own information always takes precedence.
Several serious flaws were disclosed in the AJAX plugin of JoomShaper's Helix3 template framework – including writing and deleting files and uploading PHP code without logging in. All versions before 3.1.1 are affected; the fix is available via the normal Joomla updater (currently 3.1.2). Note: Helix3 is not the same as the newer Helix Ultimate.
JoomShaper's Helix Ultimate template framework runs an AJAX handler even for visitors who aren't logged in. Before version 2.2.7, several actions ran without any login or permission check – the most serious being write access to the menus, which allows malicious script to be planted permanently (stored XSS). There is also a path-traversal file deletion, an open redirect and an unprotected template export. All versions before 2.2.7 are affected; the fix is available via the Joomla updater (currently 2.2.8). Note: Helix Ultimate is not the same as Helix3.
In the widely used Astroid Framework, a critical flaw allows files to be uploaded without any authentication – and, in the worst case, code execution (RCE). Versions 2.0.0 to 3.3.10 are affected; fixed from 3.3.11, with 3.3.13 or newer recommended (CVE-2026-21628). Already-compromised sites often show injected plugins such as "BLPayload" or "JCachePro".
The Tassos Framework (formerly Novarain) sits unnoticed inside many popular extensions such as Convert Forms or EngageBox. Unauthenticated AJAX calls allow file and database access – rated critical at CVSS 9.5, with a public exploit tool available (CVE-2026-21627). It is enough to update any one Tassos extension: the framework is automatically raised to a secure version (6.0.62+).
JCE is one of the most-used editors for Joomla. Insufficient access control allowed unauthenticated attackers to upload editor profiles and, through them, arbitrary files – and the flaw is already being actively exploited to plant web shells. All versions before 2.9.99.5 are affected (Free and Pro), regardless of whether registration is enabled. Secure is 2.9.99.5, better the follow-up 2.9.99.6.
iCagenda is a popular event calendar for Joomla. The form for submitting events lacked a real login check – so even unauthenticated attackers could upload files, even when the form was supposedly restricted to registered users. On Joomla 6 (6.0.0–6.1.1) this turns into a critical file-upload flaw (CVE-2026-48939). Affected is iCagenda 3.2.1 to 4.0.7; fixed in 4.0.8 (on Joomla 3 in 3.9.15).
SP Page Builder is one of the most-used page builders for Joomla. A zero-day flaw in the custom-icon upload function checked neither login nor file type, allowing code execution (RCE) without a login. A second flaw has since been added: an SQL injection without a login, affecting versions up to 6.7.1. Only 6.8.0 is safe. It is already being actively exploited and leaves behind hidden super-users and backdoors.
Balbooa Forms is a widely used form builder for Joomla. Its form file-upload accepts files without any login – and without checking a security token or the file type. That lets an attacker drop an executable PHP file into a publicly reachable folder and run it (remote code execution). All versions up to 2.4.0 are affected; the 2.4.1 update closes the hole (CVE-2026-56291). The flaw is already being exploited in the wild.
AcyMailing is a widely used newsletter component for Joomla. A publicly reachable front-end endpoint put request parameters into a database query unchecked. That let an unauthenticated visitor read any table – including user accounts with password hashes and site content (SQL injection). Versions 6.0.0 to 10.11.0 are affected; fixed from 10.11.1 (CVE-2026-56292).
RSFiles! is a file and download manager for Joomla. A front-end upload function could be triggered without logging in and checked neither a security token nor the file type. That lets a PHP file reach a publicly accessible directory and run there (remote code execution). All versions up to 1.17.11 are affected; the 1.17.12 update closes the hole.
A short overview without a dedicated guide page. Affected and safe versions come from the vendors; the identifiers are checked against the official CVE database.
A system plugin that hooks into the output of all content. Without logging in, attackers could run their own code on the server.
Code execution without login through a form element. Note: the interim releases 4.6.7 and 4.6.8 do not fix it.
The shop’s product filter allowed the database to be read without logging in, customer data included.
Several entry points allowed the database to be read without logging in, down to password hashes and sessions.
An insecure default allowed anonymous file uploads. The vendor ships a cleanup tool - run it after updating.
The database could be read without logging in. The advisories explicitly name the Pro edition.
Arbitrary files could be uploaded anonymously, in some cases up to code execution. The 4.0 line is unaffected.
The author filter allowed database contents to be read without logging in - read-only, but complete.
A front-end filter allowed the database to be read without logging in, down to credentials.
Listing images could be uploaded without login and without checks - a way to plant a malicious file.
Anonymous visitors could read and delete files. 2.0.2 is not enough; only 2.0.3 closes it fully.
Anonymous file upload, plus an endpoint that revealed the name and email for any user number.
