Advisories · Technology
j2commerce.com J2Store extension for Joomla.
Every CVE that names j2commerce.com J2Store extension for Joomla among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.3 Medium
Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
- j2commerce.com J2Store extension for Joomla
- CWE-1241
- CVSS 7.1 High
Joomla Extension - j2commerce.com - Missing CSRF protection on cart, checkout and myprofile controllers in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
- j2commerce.com J2Store extension for Joomla
- Cross-site request forgery (CSRF)
- CVSS 8.7 High
Joomla Extension - j2commerce.com - Arbitrary file read via `task=download` in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
- j2commerce.com J2Store extension for Joomla
- Path traversal
- CVSS 5.3 Medium
Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
- j2commerce.com J2Store extension for Joomla
- CWE-1241
- CVSS 8.7 High
Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
- j2commerce.com J2Store extension for Joomla
- SQL injection
- CVSS 8.7 High
Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
- j2commerce.com J2Store extension for Joomla
- CWE-472
- CWE-602
- CVSS 5.3 Medium
Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
- j2commerce.com J2Store extension for Joomla
- Cross-site scripting (XSS)
- CVSS 9.5 CriticalCritical · CVSS 9+
Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6
- j2commerce.com J2Store extension for Joomla
- Broken access control
- CVSS 7.1 High
Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6
- j2commerce.com J2Store extension for Joomla
- Broken access control
- CVSS 8.7 High
Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6
- j2commerce.com J2Store extension for Joomla
- CWE-472
- CWE-602
- CVSS 8.8 High
Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6
- j2commerce.com J2Store extension for Joomla
- Broken access control
- CVSS 6.9 Medium
Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
- j2commerce.com J2Store extension for Joomla
- Cross-site request forgery (CSRF)
- Information disclosure
- CVSS 8.6 High
Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
- j2commerce.com J2Store extension for Joomla
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
- j2commerce.com J2Store extension for Joomla
- Cross-site request forgery (CSRF)
- Broken access control
- CVSS 5.1 Medium
Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
- j2commerce.com J2Store extension for Joomla
- Open redirect
- CVSS 8.7 High
Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
- j2commerce.com J2Store extension for Joomla
- Broken access control
- CVSS 6.3 Medium
Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
- j2commerce.com J2Store extension for Joomla
- Broken access control