Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

DJ-Classifieds extension lets attackers run database queries

CVE-2026-105604 · published 5 days ago
Summary

The DJ-Classifieds add‑on for Joomla lets anyone on the public website send specially crafted search requests that cause the site’s database to run unexpected commands. This can expose or change stored information without needing a login. Update the extension to version 3.11.3 or later, or remove it if you cannot apply the update.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
dj-extensions.com dj-classifieds extension for joomla 1.0-3.11.2
Original advisory text
Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3
Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated SQL injection vector in the frontend search.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published2 Nov 2026
Updated7 Nov 2026
First seen2 Nov 2026
Sources
CVE-2026-105604 · NVD
CVE-2026-105604 · MITRE
Track software like this
Free during beta