CVE-2026-102800

Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0 - The “was this article helpful” voting widget posts a client-supplied ip field to its AJAX handlers (getDeny, getConfirm, getDenyReason in mod_djhelpful_articles/helper.php), reachable without authentication through com_ajax. The value was stored exactly as submitted instead of being taken from the connection by the server. It was then printed without output escaping in the administrator backend’s “Helpful articles” overview (views/items/tmpl/default.php). $db->quote() was applied on insert, which protects the SQL statement but does nothing for HTML output. There was no CSRF token, no rate limit, and the vote de-duplication keyed on the same attacker-controlled field.

• CWE-79

• https://www.dj-extensions.com/

Published

Oct 27, 2026

Last Modified

Oct 27, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102795Improper Access Control vulnerability in Apache Traffic Serv…9.3
• CVE-2026-102796Improper Neutralization of Special Elements used in an SQL C…7.5
• CVE-2026-102797Server-Side Request Forgery (SSRF) vulnerability in ThemeREX…6.4
• CVE-2026-102798Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2026-102799Joomla Extension - icagenda.com - CSV formula injection in t…5.3
• CVE-2026-10280A security flaw has been discovered in horizon921 mcpilot 0.…7.3
• CVE-2026-102804A vulnerability was detected in Nothings stb up to 2c980bb59…6.5
• CVE-2026-102805A flaw has been found in Nothings stb up to 1.16. This affec…6.5
• CVE-2026-102806OpenClaw before 2026.9.5 contains an incorrect authorization…6.3
• CVE-2026-102807OpenClaw before 2026.9.4 contains an incorrect authorization…5.3
• CVE-2026-102808PX4 Autopilot through 1.17.0 contains a NULL pointer derefer…6.5
• CVE-2026-102809PX4 Autopilot through 1.17.0 contains an uncontrolled stack …6.5