CVE-2026-118494High· 8.2▾ TwilightJoomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9 - JReviews caches its full settings table, including the Joomla global configuration secret (copied into cms_secret) and th…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9 - JReviews caches its full settings table, including the Joomla global configuration secret (copied into cms_secret) and third-party API keys and secrets, to a serialized file under components/com_s2framework/tmp/cache/core/ inside the web root. The file has no PHP guard and the directory has no .htaccess, so anyone who knows the file name can read it without authentication.
com_jreviews 6.0.0-6.6.9com_jreviews 1.0.0-5.12.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-56065High· 7.5WordPress Doofinder for WooCommerce plugin <= 2.17.2 - Sensitive Data Exposure vulnerability
CVE-2012-4574Medium· 5.5Pulp: red hat cloudforms: pulp in red hat cloudforms: information disclosure via world-readable configuration file
CVE-2026-115707Medium· 6.4Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation
CVE-2026-115711Medium· 6.4Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Credential Disclosure
CVE-2026-114195Medium· 5.3WordPress ShopMagic plugin <= 4.9.1 - Sensitive Data Exposure vulnerability
CVE-2026-112027Medium· 5.3cms: light0011 cms: Information disclosure via filename manipulation in Uploadify (CVE-2026-112027)