JoomSky vulnerabilities

Products

• JS Help Desk 16
• JS Job Manager 11
• js jobs 8
• J2 JOBS 2
• js autoz 1
• js support ticket 1
• WP Vehicle Manager 1

Latest JoomSky CVEs

Newest publication first · page 1 of 2

1. CVE-2026-57652 WordPress JS Help Desk plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability

   Published 2026-06-26

   Medium·CVSS 5.3 EPSS 0.31%

   Unauthenticated Insecure Direct Object References (IDOR) in JS Help Desk <= 3.1.0 versions.

2. CVE-2019-25740 Joomla com_jsjobs 1.2.6 Arbitrary File Deletion

   Published 2026-06-04

   High·CVSS 7.1 EPSS 0.33%

   Joomla com_jsjobs 1.2.6 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating custom userfield parameters. Attackers can send POST requests to the job.savejob task with path traversal sequences in the field_2 paramet...

3. CVE-2018-25327 Joomla! Component Js Jobs 1.2.0 Cross-Site Request Forgery

   Published 2026-05-17

   Medium·CVSS 6.9 EPSS 0.14%

   Joomla! Component Js Jobs 1.2.0 contains a cross-site request forgery vulnerability that allows attackers to perform state-changing actions without token validation. Attackers can craft malicious HTML forms targeting administrative endpoints like job.jobenforcedelete to delete jo...

4. CVE-2020-37226 Joomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortby

   Published 2026-05-13

   High·CVSS 7.1 EPSS 0.27%

   Joomla J2 JOBS 1.3.0 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'sortby' parameter. Attackers can send POST requests to the administrator index with malicious 'sortby'...

5. CVE-2020-37224 Joomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortby

   Published 2026-05-13

   High·CVSS 7.1 EPSS 0.27%

   Joomla J2 JOBS 1.3.0 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'sortby' parameter. Attackers can send POST requests to the administrator index with malicious 'sortby'...

6. CVE-2026-32535 WordPress JS Help Desk plugin <= 3.0.3 - Insecure Direct Object References (IDOR) vulnerability

   Published 2026-03-25

   Medium·CVSS 6.5 EPSS 0.17%

   Authorization Bypass Through User-Controlled Key vulnerability in JoomSky JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through <= 3.0.3.

7. CVE-2026-32534 WordPress JS Help Desk plugin <= 3.0.3 - SQL Injection vulnerability

   Published 2026-03-25

   High·CVSS 8.5 EPSS 0.23%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL Injection.This issue affects JS Help Desk: from n/a through <= 3.0.3.

8. CVE-2026-24959 WordPress JS Help Desk plugin <= 3.0.1 - SQL Injection vulnerability

   Published 2026-02-20

   High·CVSS 8.5 EPSS 0.25%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL Injection.This issue affects JS Help Desk: from n/a through <= 3.0.1.

9. CVE-2025-58234 WordPress JS Job Manager Plugin <= 2.0.2 - Cross Site Scripting (XSS) Vulnerability

   Published 2025-09-22

   Medium·CVSS 5.4 EPSS 0.22%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomSky JS Job Manager js-jobs allows Stored XSS.This issue affects JS Job Manager: from n/a through <= 2.0.2.

10. CVE-2025-32626 WordPress JS Job Manager plugin <= 2.0.2 - SQL Injection vulnerability

    Published 2025-04-17

    Critical·CVSS 9.8 EPSS 0.52%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Job Manager js-jobs allows SQL Injection.This issue affects JS Job Manager: from n/a through <= 2.0.2.

11. CVE-2025-32660 WordPress JS Job Manager plugin <= 2.0.2 - Arbitrary File Upload vulnerability

    Published 2025-04-17

    Critical·CVSS 9.8 EPSS 0.47%

    Unrestricted Upload of File with Dangerous Type vulnerability in JoomSky JS Job Manager js-jobs allows Upload a Web Shell to a Web Server.This issue affects JS Job Manager: from n/a through <= 2.0.2.

12. CVE-2025-32627 WordPress JS Job Manager plugin <= 2.0.2 - Local File Inclusion vulnerability

    Published 2025-04-11

    High·CVSS 8.1 EPSS 0.97%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JoomSky JS Job Manager js-jobs allows PHP Local File Inclusion.This issue affects JS Job Manager: from n/a through <= 2.0.2.

13. CVE-2025-32146 WordPress JS Job Manager plugin <= 2.0.2 - Local File Inclusion vulnerability

    Published 2025-04-04

    High·CVSS 8.8 EPSS 0.80%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JoomSky JS Job Manager js-jobs allows PHP Local File Inclusion.This issue affects JS Job Manager: from n/a through <= 2.0.2.

14. CVE-2025-31867 WordPress JS Job Manager Plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability

    Published 2025-04-01

    Medium·CVSS 5.4 EPSS 0.39%

    Authorization Bypass Through User-Controlled Key vulnerability in JoomSky JS Job Manager js-jobs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Job Manager: from n/a through <= 2.0.2.

15. CVE-2025-31868 WordPress JS Job Manager plugin <= 2.0.2 - Broken Access Control vulnerability

    Published 2025-04-01

    Medium·CVSS 5.3 EPSS 0.35%

    Missing Authorization vulnerability in JoomSky JS Job Manager js-jobs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Job Manager: from n/a through <= 2.0.2.

16. CVE-2025-30901 WordPress JS Help Desk plugin <= 2.9.2 - Local File Inclusion vulnerability

    Published 2025-04-01

    High·CVSS 8.1 EPSS 0.89%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JoomSky JS Help Desk js-support-ticket allows PHP Local File Inclusion.This issue affects JS Help Desk: from n/a through <= 2.9.2.

17. CVE-2025-30886 WordPress JS Help Desk plugin <= 2.9.2 - SQL Injection vulnerability

    Published 2025-04-01

    Critical·CVSS 10.0 EPSS 0.54%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows SQL Injection.This issue affects JS Help Desk: from n/a through <= 2.9.2.

18. CVE-2025-30882 WordPress JS Help Desk plugin <= 2.9.1 - Arbitrary File Download vulnerability

    Published 2025-04-01

    High·CVSS 7.5 EPSS 0.61%

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in JoomSky JS Help Desk js-support-ticket allows Path Traversal.This issue affects JS Help Desk: from n/a through <= 2.9.1.

19. CVE-2025-30878 WordPress JS Help Desk plugin <= 2.9.2 - Arbitrary File Deletion vulnerability

    Published 2025-04-01

    Critical·CVSS 9.1 EPSS 0.65%

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in JoomSky JS Help Desk js-support-ticket allows Path Traversal.This issue affects JS Help Desk: from n/a through <= 2.9.2.

20. CVE-2025-30880 WordPress JS Help Desk plugin <= 2.9.2 - Broken Access Control vulnerability

    Published 2025-04-01

    High·CVSS 7.5 EPSS 0.51%

    Missing Authorization vulnerability in JoomSky JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through <= 2.9.2.

21. CVE-2025-25109 WordPress Vehicle Manager plugin <= 3.1 - Local File Inclusion vulnerability

    Published 2025-03-03

    High·CVSS 8.1 EPSS 0.84%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JoomSky WP Vehicle Manager js-vehicle-manager allows PHP Local File Inclusion.This issue affects WP Vehicle Manager: from n/a through <= 3.1.

22. CVE-2025-22208 Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.3 for Joomla

    Published 2025-02-15

    Medium·CVSS 4.7 EPSS 0.65%

    A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'filter_email' parameter in the GDPR Erase Data Request search feature.

23. CVE-2025-22209 Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.3 for Joomla

    Published 2025-02-15

    Medium·CVSS 4.7 EPSS 0.30%

    A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'searchpaymentstatus' parameter in the Employer Payment History search feature.

24. CVE-2025-22206 Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.2 for Joomla

    Published 2025-02-04

    Medium·CVSS 4.7 EPSS 9.2%

    A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.2 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'fieldfor' parameter in the GDPR Field feature.

25. CVE-2022-46838 WordPress JS Help Desk plugin <= 2.7.1 - Unauthenticated Settings Change Vulnerability

    Published 2024-12-13

    Critical·CVSS 9.1 EPSS 0.73%

    Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.