# joomshaper.com SP Page Builder extension for Joomla.

Every CVE that names joomshaper.com SP Page Builder extension for Joomla among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0](https://agentprime.io/advisories/CVE-2026-67287.md)
  `CVE-2026-67287` · CVE record: joomshaper.com SP Page Builder extension for Joomla · CVSS 6.3 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Broken access control
- [Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0](https://agentprime.io/advisories/CVE-2026-67286.md)
  `CVE-2026-67286` · CVE record: joomshaper.com SP Page Builder extension for Joomla · CVSS 6.3 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal
- [Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0](https://agentprime.io/advisories/CVE-2026-67285.md)
  `CVE-2026-67285` · CVE record: joomshaper.com SP Page Builder extension for Joomla · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal
- [Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0](https://agentprime.io/advisories/CVE-2026-66494.md)
  `CVE-2026-66494` · CVE record: joomshaper.com SP Page Builder extension for Joomla · CVSS 8.7 High · Not analysed yet · Published 7 Aug 2026 · Tags: Cross-site scripting (XSS), Broken access control
- [Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0](https://agentprime.io/advisories/CVE-2026-65876.md)
  `CVE-2026-65876` · CVE record: joomshaper.com SP Page Builder extension for Joomla · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jul 2026 · Tags: SQL injection
- [Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1](https://agentprime.io/advisories/CVE-2026-65877.md)
  `CVE-2026-65877` · CVE record: joomshaper.com SP Page Builder extension for Joomla · CVSS 8.2 High · Not analysed yet · Published 27 Jul 2026 · Tags: SQL injection
- [Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1](https://agentprime.io/advisories/CVE-2026-65879.md)
  `CVE-2026-65879` · CVE record: joomshaper.com SP Page Builder extension for Joomla · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jul 2026 · Tags: Hard-coded credentials
- [Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1](https://agentprime.io/advisories/CVE-2026-65766.md)
  `CVE-2026-65766` · CVE record: joomshaper.com SP Page Builder extension for Joomla · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jul 2026 · Tags: SQL injection
- [Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1](https://agentprime.io/advisories/CVE-2026-65878.md)
  `CVE-2026-65878` · CVE record: joomshaper.com SP Page Builder extension for Joomla · CVSS 8.3 High · Not analysed yet · Published 27 Jul 2026 · Tags: Path traversal

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=joomshaper-com-sp-page-builder-extension-for-joomla>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/joomshaper-com-sp-page-builder-extension-for-joomla/>. Everything for agents: <https://agentprime.io/llms.txt>.