---
id: "CVE-2026-105604"
kind: "vulnerability"
aliases: ["CVE-2026-105604"]
title: "DJ-Classifieds Joomla extension: unauthenticated SQL injection in frontend search"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["dj-classifieds", "joomla", "other", "self-hosted"]
not_affected_if: ["extension-not-installed", "version-3.11.3-or-later"]
published_at: "2026-11-02T19:17:49+00:00"
first_seen_at: "2026-11-02T19:24:38+00:00"
updated_at: "2026-11-02T19:26:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105604", "first_seen_at": "2026-11-02T19:24:38+00:00"}]
---

# DJ-Classifieds Joomla extension: unauthenticated SQL injection in frontend search

DJ-Classifieds, a classifieds extension for the Joomla content management system, has an SQL injection flaw in its frontend search. An anonymous visitor can send crafted search input that changes the database query, which can expose or alter site data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed DJ-Classifieds version in the Joomla administrator under Extensions > Manage, and confirm whether it is below `3.11.3`.

## Fix

- DJ-Classifieds: `3.11.3` or later
- Source gives no further detail beyond the fixed version.

## Timeline

- 2026-11-02T19:24:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105604

## From the sources

Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated SQL injection vector in the frontend search.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_