CVE-2026-105604

{
  "etk_id": "ETK-2026-3308",
  "cve_id": "CVE-2026-105604",
  "display_id": "CVE-2026-105604",
  "ghsa_id": "GHSA-g3qw-rp5c-h7mm",
  "euvd_id": "EUVD-2026-115359",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated SQL injection in DJ-Classifieds",
  "summary": "DJ-Classifieds versions before 3.11.3 are affected by an SQL injection flaw in the public search functionality. An unauthenticated remote attacker may be able to influence database queries when the frontend search is reachable.",
  "mitigation": "Restrict access to the frontend search feature to trusted users or networks until remediation is confirmed. Move off versions earlier than 3.11.3 and verify the replacement release with the vendor.",
  "vendor": "dj-extensions.com",
  "product": "DJ-Classifieds extension for Joomla",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "1.0-3.11.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "DJ-Classifieds extension for Joomla",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 20.020810583333333,
  "t0_at": "2026-11-02T18:27:14.810000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-02T18:27:14.810000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-02T18:27:14.810000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105604"
    }
  }
}