CVE-2026-100750

Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla - Modules Anywhere Pro lets additional attributes on a module tag replace arbitrary parameters of the selected module. This feature is enabled by default in affected versions. The overrides are applied without checking who authored the content containing the tag. The security effect depends on how the selected module consumes the replaced parameter. Joomla's core Feed module provides a concrete affected path: its rssurl parameter is opened by the server and accepts local file: URLs as well as network URLs.

• CWE-918

• https://www.regularlabs.com/

Published

Sep 28, 2026

Last Modified

Sep 28, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100745A vulnerability has been found in Edimax BR-6428nC 1.16. The…6.3
• CVE-2026-100746A vulnerability was found in coollabsio Coolify up to 4.1.0.…7.3
• CVE-2026-100747Joomla Extension - svenbluege.de - CSRF in image upload in E…5.1
• CVE-2026-100748Joomla Extension - svenbluege.de - CSRF in various cart acti…6.9
• CVE-2026-100749Joomla Extension - svenbluege.de - CSRF in backend cleanup a…5.1
• CVE-2026-10075DreamMaker developed by Interinfo has a Path Traversal vulne…6.9
• CVE-2026-100751Joomla Extension - regularlabs.com - Privileged stored XSS v…7.5
• CVE-2026-100752Joomla Extension - ordasoft.com - Unauthenticated SQL Inject…9.3
• CVE-2026-100753Joomla Extension - ordasoft.com - Reflected Cross-Site Scrip…5.3
• CVE-2026-10077The yootheme WordPress theme before 5.0.35 does not prevent …6.8
• CVE-2026-10078A flaw was found in the Quay config-tool's GitLab OAuth vali…2.7
• CVE-2026-10079A flaw was found in Red Hat Advanced Cluster Security for Ku…8.5