← Back

Widgetfactorylimited

widgetfactorylimited

4 CVEs • 2 products

Products (2)

Click to collapse
Toggle
Jce
jce
3 CVEs
Com Jce
com_jce
1 CVE

CVEs (4)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2026-65891
1Widgetfactorylimited
1Jce
Aug 5, 2026
Jul 29, 2026
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) < 2.20.2 - Improper input validation in the file rename functionality...Show more
Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) < 2.20.2 - Improper input validation in the file rename functionality allowed an authenticated user with file management permissions to rename files to otherwise invalid names, resulting in the creation of hidden files. The issue also allowed existing files at the destination path to be unintentionally replaced.Show less
CVE-2026-48907
1Widgetfactorylimited
1Jce
Jul 23, 2026
Jun 5, 2026
10.0 CRITICAL· v4
9.8 CRITICAL· v3
N/A· v2
A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.
CVE-2015-7339
1Widgetfactorylimited
1Jce
Nov 21, 2024
Mar 9, 2020
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
JCE Joomla Component 2.5.0 to 2.5.2 allows arbitrary file upload via a .php file extension for an image file to the /com_jce/editor/libraries/classes/browser.php script.
CVE-2011-5134
1Widgetfactorylimited
1Com Jce
Apr 29, 2026
Aug 30, 2012
N/A· v4
N/A· v3
6.0 MEDIUM· v2
Unrestricted file upload vulnerability in editor/extensions/browser/file.php in the JCE component before 2.0.18 for Joomla! allows remote authenticated users with the author privileges to execute arbitrary PHP code by up...Show more
Unrestricted file upload vulnerability in editor/extensions/browser/file.php in the JCE component before 2.0.18 for Joomla! allows remote authenticated users with the author privileges to execute arbitrary PHP code by uploading a file with a double extension, as demonstrated by .php.gif. NOTE: some of these details are obtained from third party information.Show less