CVE-2026-90900

Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product review submission endpoint (index.php?option=com_easystore&task=product.addReview) accepted submissions without verifying an anti-CSRF token (the check had been commented out in code). An attacker could trick a logged-in user into posting unauthorized reviews or submitting review spam via cross-site requests. Resolved by enforcing Session::checkToken('request') / Session::checkToken('post') in ProductController, injecting HTMLHelper::_('form.token') into the review form template, and appending the session token to the submission payload in review-form.js.

• CWE-352

• https://www.joomshaper.com/easystore

Published

Sep 23, 2026

Last Modified

Sep 23, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-90894Parallels Desktop runs prl_disp_service as root. Local clien…7.8
• CVE-2026-90895Affected versions of MISP’s interactive CLI shell implement …8.4
• CVE-2026-90896Missing Authentication for Critical Function (CWE-306) in th…8.2
• CVE-2026-90898Bifrost registers MCP clients through its management API. A …9.8
• CVE-2026-90899Joomla Extension - joomshaper.com - Unauthenticated PII Expo…8.2
• CVE-2026-9090Casdoor versions 2.362.0 and earlier contain a vulnerability…9.1
• CVE-2026-90901Joomla Extension - joomshaper.com - Authenticated, Privilege…8.6
• CVE-2026-90902Joomla Extension - joomshaper.com - Authenticated, Privilege…8.6
• CVE-2026-90903Joomla Extension - joomshaper.com - Missing CSRF Token Verif…7.2
• CVE-2026-90904Joomla Extension - joomshaper.com - Broken Access Control (A…8.6
• CVE-2026-90905Joomla Extension - joomshaper.com - Missing CSRF and Access …7.2
• CVE-2026-9091Casdoor versions 2.362.0 and earlier contain a logic flaw in…5.3