medium · CVSS v3 5.4 · CVSS v4 5.3

CVE-2026-105605

An IDOR flaw in the Joomla DJ-Classifieds extension allows any logged‑in user to retrieve the full details of any advertisement by supplying

Overview

An IDOR flaw in the Joomla DJ-Classifieds extension allows any logged‑in user to retrieve the full details of any advertisement by supplying its numeric ID. The issue exists in all versions prior to 3.11.3 and exposes sensitive advertiser information such as phone numbers, addresses, and prices. It can be exploited without any special privileges or external access.

Description

Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds < 3.11.3 - A “duplicate my ad” convenience feature on the new-ad form (site/models/additem.php) loaded an existing advert by its raw numeric ID with no check that the ad belonged to the requesting user, and no check of whether it was published, blocked, or still a pending draft. Any logged-in user, regardless of role, could request the new-ad form with another ad’s ID and have that ad’s full content, including the seller’s phone number, address, email, and price, rendered into the response, even for ads that had never been published. Advert IDs are small sequential integers.

Impact

Confidentiality: advertiser contact details and pricing are exposed to all logged‑in users. Integrity: while the flaw does not alter data, it could be leveraged for social engineering or phishing. Availability: no impact. Impacted parties: all site users, advertisers, and site administrators who rely on the extension for classified listings.

Remediation

Upgrade DJ-Classifieds to version 3.11.3 or later where the duplicate‑ad feature validates ownership and publication status. If an upgrade is not immediately possible, disable the duplicate‑ad functionality or implement a server‑side check that verifies the requesting user owns the ad before rendering its details.

Risk context

The vulnerability has a medium severity rating (CVSS v3 5.4, v4 5.3) and no EPSS data is available. While it does not affect availability, the exposure of personal contact information warrants timely remediation.

Affected products

  • Joomla
  • DJ-Classifieds
  • dj-extensions.com

Scores

Severity
medium
CVSS v2
5.5
CVSS v3
5.4
CVSS v4
5.3
EPSS
—

IDOR Joomla DJ-Classifieds advertisement confidentiality medium access-control

← All CVEs

Related CVEs

medium

CVE-2026-105770

Octo STS (github.com/octo-sts/app) before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy. TrustPolicy.CheckToken included the policy's issuer, subject and audience values or patterns and claim_pattern names and regular expressions in its PermissionDenied errors, which Exchange returned verbatim. Exchange also selected the GitHub App installation before checking the token, so errors from resolving the policy's app or app_pattern pin were returned to callers the policy does not trust. An attacker who holds any validly signed OIDC token, such as a GitHub Actions token from a repository they own, and who knows or guesses a target owner/repo and identity name can read that policy's matching rules, even when the policy is stored in a private repository. These rules often name internal repositories, branches, environments or cloud account identifiers. The issue does not allow minting tokens or bypassing a trust policy. This issue is fixed in 0.11.2.

View analysis

medium

CVE-2026-111464

The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.3. The plugin caches the response of Core’s wp-activate.php without honoring its no-store/no-cache headers, the wp-activate-* cookie, or the WP_INSTALLING state, writing the credential-bearing activation response to a publicly accessible cache file. This makes it possible for unauthenticated attackers to retrieve the plaintext username and twelve-character password of the most recently activated Multisite registrant from that cached wp-activate.php response. Exploitation requires a Multisite subdirectory installation with public user and site registration enabled, and the credentials are only exposed after a genuine registrant follows their activation link.

View analysis

medium

CVE-2026-120237

A flaw in ag-ui-protocol ag-ui up to 0.0.58 allows manipulation of the isInterruptExpired function, leading to excessive resource consumption. The vulnerability can be exploited remotely and an exploit is publicly available. Patching to a fixed version is required to mitigate the risk.

View analysis

medium

CVE-2026-120334

A path‑traversal flaw exists in deepset‑ai farm 0.8.0 and earlier, allowing remote attackers to read arbitrary files via the vocab_filename argument in EmbeddingTokenizer.from_pretrained. The vulnerability is publicly known and can be exploited without authentication. It affects any deployments of the unsupported farm library.

View analysis