« Volver al listado

CVE-2026-64795

Estado: AplazadaMedia (5.4)—

Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’ browsers.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Joomla — JoomlaAIRegularlabs — Joomla ExtensionsAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-64795",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-64795",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-27T13:24:53.127808Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security@joomla.org",
      "affectedData": [
        {
          "vendor": "regularlabs.com",
          "product": "Modals extension for Joomla",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0-15.0.0"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "regularlabs.com",
          "product": "Tooltips extension for Joomla",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0-9.4.7"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "regularlabs.com",
          "product": "Articles Anywhere Pro extension for Joomla",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0-18.0.2"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "regularlabs.com",
          "product": "Users Anywhere Pro extension for Joomla",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0-1.2.7"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "regularlabs.com",
          "product": "Modules Anywhere Pro extension for Joomla",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0-8.4.1"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-07-22T21:18:10.660",
  "references": [
    {
      "url": "https://regularlabs.com/",
      "source": "security@joomla.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@joomla.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’ browsers."
    }
  ],
  "lastModified": "2026-07-27T14:16:59.660",
  "sourceIdentifier": "security@joomla.org"
}