{"id":"CVE-2026-105604","kind":"vulnerability","aliases":["CVE-2026-105604"],"related":[],"title":"DJ-Classifieds Joomla extension: unauthenticated SQL injection in frontend search","description":"Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated SQL injection vector in the frontend search.","summary":"DJ-Classifieds, a classifieds extension for the Joomla content management system, has an SQL injection flaw in its frontend search. An anonymous visitor can send crafted search input that changes the database query, which can expose or alter site data.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dj-classifieds","joomla","other","self-hosted"],"not_affected_if":["extension-not-installed","version-3.11.3-or-later"],"how_to_check":"- Check the installed DJ-Classifieds version in the Joomla administrator under Extensions > Manage, and confirm whether it is below `3.11.3`.","fix":"- DJ-Classifieds: `3.11.3` or later\n- Source gives no further detail beyond the fixed version.","status":"open","published_at":"2026-11-02T19:17:49+00:00","first_seen_at":"2026-11-02T19:24:38+00:00","triaged_at":"2026-11-02T19:26:32+00:00","updated_at":"2026-11-02T19:26:32+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-02T19:26:32Z","model":"claude-haiku-5-5","output":{"fix":"- DJ-Classifieds: `3.11.3` or later\n- Source gives no further detail beyond the fixed version.","reach":"internet","title":"DJ-Classifieds Joomla extension: unauthenticated SQL injection in frontend search","impact":"high","summary":"DJ-Classifieds, a classifieds extension for the Joomla content management system, has an SQL injection flaw in its frontend search. An anonymous visitor can send crafted search input that changes the database query, which can expose or alter site data.","audience":"businesses","category":"other","nicknames":[],"who_cares":["joomla","dj-classifieds","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"database contents readable or modifiable by anonymous internet visitors","analyst_note":"Confirm the affected version range and the vendor advisory at dj-extensions.com; the NVD entry gives only the fixed version.","how_to_check":"- Check the installed DJ-Classifieds version in the Joomla administrator under Extensions > Manage, and confirm whether it is below `3.11.3`.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["extension-not-installed","version-3.11.3-or-later"],"who_is_affected":"Sites running the DJ-Classifieds extension on Joomla with a version below 3.11.3 are exposed through the public frontend search, which needs no login. Joomla sites without this extension are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000688,"input_tokens":4134,"output_tokens":549,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-105604':14A,17A '-2026':13A,16A '3.11.3':77C 'alter':64B 'anonym':48B 'chang':56B 'classifi':3A,20B,28B,30B,76C,83C 'content':35B 'craft':52B 'cve':12A,15A 'data':66B 'databas':58B 'dj':2A,19B,27B,75C,82C 'dj-classifi':1A,18B,26B,74C,81C 'dj-extensions.com':69C 'expos':62B 'extens':5A,31B,68C,80C 'flaw':42B 'frontend':10A,45B,94C 'host':25B 'inject':8A,41B,72C,90C 'input':54B 'joomla':4A,21B,34B,67C,79C 'manag':36B 'queri':59B 'search':11A,46B,53B,95C 'self':24B 'self-host':23B 'send':51B 'site':65B 'sql':7A,40B,71C,89C 'system':37B 'unauthent':6A,70C,88C 'vector':91C 'visitor':49B 'vulner':85C","nicknames":[],"mitigations":[],"who_affected":"Sites running the DJ-Classifieds extension on Joomla with a version below 3.11.3 are exposed through the public frontend search, which needs no login. Joomla sites without this extension are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","djclassifieds","joomla","other","selfhosted"],"first_public_at":"2026-11-02T19:17:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105604","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105604","severity":null,"published_at":"2026-11-02T19:17:49+00:00","modified_at":"2026-11-02T19:17:49+00:00","first_seen_at":"2026-11-02T19:24:38+00:00","fetched_at":"2026-11-02T19:24:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}