CVE Feed

    Dashboard / CVE / CVE-2026-100749

    CVE-2026-100749

    Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 - Only orphaned file entries and shopping carts that are older than 30 days will be deleted.

    Published:Sep 27, 2026
    Last Modified:Oct 27, 2026
    EPS:Sep 27, 2026
    EPSS Score:0.00146
    CVSS Score:4.3

    Affected Products

    Vendor
    Svenbluege
    Product
    Event Gallery
    Vendor
    Svenbluege.de
    Product
    Event Gallery For Joomla

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-352 Cross-Site Request Forgery

    Related CVEs

    CVE-2026-102777 (CVSS 6.3) — Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery ex…
    CVE-2026-102778 (CVSS 5.3) — Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gall…
    CVE-2026-102776 (CVSS 5.1) — Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery ex…
    CVE-2026-100748 (CVSS 6.9) — Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0…
    CVE-2026-97164 (CVSS 7) — Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in Event Galler…
    CVE-2026-100747 (CVSS 5.1) — Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to lack of an…
    CVE-2026-97165 (CVSS 5.3) — Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0 - The “r…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High