What happened
Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
Affected versions
UP plugin for Joomla: 5.0.0-5.2.0; 6.0.0-6.0.29 Fixed: See vendor advisory.
Why it matters
Review the vendor advisory and exposure of the affected product to determine operational impact.
Detection & mitigation
- Apply vendor-provided updates or mitigations.
- Review affected product exposure and access logs.
Public PoC references
RepositoryAuthorFirst seenReference
SploitusUnauthenticated remote code installation in UP 5.0.0–5.2.0 and 6.0.0–6.0.29 via GitHub.murrez2026-09-26T20:55:27Verifiedmurrez/CVE-2026-97163Unauthenticated remote code installation in UP 5.0.0–5.2.0 and 6.0.0–6.0.29 via GitHub.murrez2026-09-26T20:55:27VerifiedSploitusAuthenticated PHP code injection in UP plugin 5.0.0–5.2.0 and 6.0.0–6.0.29 via shortcodes.murrez2026-09-26T20:46:20Verifiedmurrez/CVE-2026-97160Authenticated PHP code injection in UP plugin 5.0.0–5.2.0 and 6.0.0–6.0.29 via shortcodes.murrez2026-09-26T20:46:20VerifiedSource timeline
CVE record published by NVDView source ↗
Record history
Record created from the first normalized source observation.
Metadata and source references refreshed.