VYPR
← All advisories
High severity8.8NVD Advisory· Published Sep 26, 2026· Updated Oct 20, 2026

CVE-2026-97160

CVE-2026-97160

Description

Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

Affected products

2
  • Joomla/UP pluginllm-fuzzy
    Range: 5.0.0-5.2.0, 6.0.0-6.0.29
  • Lomart/Up
    cpe:2.3:a:lomart:up:*:*:*:*:*:joomla\!:*:*
    Range: >=5.0.0,<=5.2.0

Patches

Vulnerability mechanics

References

1

News mentions

2