CVE-2026-118494
Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9 - JReviews caches its full settings table, including the Joomla global configuration secret (copied into cms_secret) and third-party API keys and secrets, to a serialized file under components/com_s2framework/tmp/cache/core/ inside the web root. The file has no PHP guard and the directory has no .htaccess, so anyone who knows the file name can read it without authentication.
| CWE | CWE-538 |
| Vendor | jreviews.com |
| Product | jreviews component for joomla |
| Published | Nov 5, 2026 |
| Last Updated | Nov 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for jreviews.com jreviews component for joomla
Be the first to know when new unknown vulnerabilities affecting jreviews.com jreviews component for joomla are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
jreviews.com / JReviews component for Joomla
6.0.0-6.6.9 1.0.0-5.12.0