CVE-2026-118494
— UNSCOREDPublished 2026-11-05 · Updated 2026-11-05
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9 - JReviews caches its full settings table, including the Joomla global configuration secret (copied into cms_secret) and third-party API keys and secrets, to a serialized file under components/com_s2framework/tmp/cache/core/ inside the web root. The file has no PHP guard and the directory has no .htaccess, so anyone who knows the file name can read it without authentication.
Weaknesses
CWE-538
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-108937PoC
- MEDIUMCVE-2026-109970
- MEDIUMCVE-2026-112027PoC
- MEDIUMCVE-2026-114195
- MEDIUMCVE-2026-115707
- MEDIUMCVE-2026-115711
- MEDIUMCVE-2026-119199PoC
- MEDIUMCVE-2026-12762
Related by shared AI tags and CWE weakness class. Browse the full archive.