What happened
Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
Affected versions
UP plugin for Joomla: 5.0.0-5.2.0; 6.0.0-6.0.29 Fixed: See vendor advisory.
Why it matters
Review the vendor advisory and exposure of the affected product to determine operational impact.
Detection & mitigation
- Apply vendor-provided updates or mitigations.
- Review affected product exposure and access logs.
Public PoC references
RepositoryAuthorFirst seenReference
SploitusAuthenticated PHP code injection in UP plugin 5.0.0–5.2.0 and 6.0.0–6.0.29 via shortcodes.murrez2026-09-26T20:46:20VerifiedSploitusUnauthenticated remote code installation in UP 5.0.0–5.2.0 and 6.0.0–6.0.29 via GitHub.murrez2026-09-26T20:55:27Verifiedmurrez/CVE-2026-97163Unauthenticated remote code installation in UP 5.0.0–5.2.0 and 6.0.0–6.0.29 via GitHub.murrez2026-09-26T20:55:27VerifiedSploitusUnauthenticated path traversal/file read in UP 5.0.0–5.2.0 and 6.0.0–6.0.29 via ajax-view.murrez2026-09-26T20:50:57Verifiedmurrez/CVE-2026-97161Unauthenticated path traversal/file read in UP 5.0.0–5.2.0 and 6.0.0–6.0.29 via ajax-view.murrez2026-09-26T20:50:57Verifiedmurrez/CVE-2026-97160CVE-2026-97160 PoC for Joomla UP (lomart.fr): privileged {up php=} shortcode eval code injection in versions 5.0.0–5.2.0 and 6.0.0–6.0.29 (fix 5.2.1 / 6.1.0). Detects plugin version and verifies public article execution. ★ 0murrez2026-09-26VerifiedSource timeline
CVE record published by NVDView source ↗
Record history
Record created from the first normalized source observation.
Metadata and source references refreshed.