Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2

Why this deserves its current priority

CVSS is 10.0. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps dj-extensions.com/DJ-Classifieds extension for Joomla (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for dj-extensions.com/DJ-Classifieds extension for Joomla.
2. 2Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

1. Published upstream

   Jul 20, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Aug 12, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Aug 12, 2026

Sources and claim methodology

• Source referencedj-extensions.com
• Source referencemysites.guru

Related CVEs

• Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form FieldAlso CWE-434
• Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0Also CWE-434
• capgo through 12.128.2 IDOR via PUT /app icon endpointSame generic ecosystem
• Budibase Server before 3.45.0 Arbitrary File Write via ZIP SymlinkSame generic ecosystem
• Budibase before 3.45.0 SQL Injection via column-rename DDLSame generic ecosystem
• Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDCSame generic ecosystem