JF
Product
JoomSport – for Sports: Team & League, Football, Hockey & more
11
CVEs
0
On KEV
9.8
Max CVSS
2
New 30D
Severity mix
Critical 1High 2Medium 8Low 0
Watch
Add JoomSport – for Sports: Team & League, Football, Hockey & more to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-7721 | 9.8 | Oct 3 | JoomSport <= 5.7.3 - Unauthenticated Directory Traversal to Local File Inclusion Affected: through 5.7.3 |
| CVE-2026-6929 | 7.5 | May 13 | JoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' Parameter Affected: through 5.7.7 |
| CVE-2024-12633 | 7.1 | Jan 7 | JoomSport <= 5.6.17 - Reflected Cross-Site Scripting via page Affected: through 5.6.17 |
| CVE-2026-118698 New | 6.5 | Oct 30 | JoomSport <= 5.7.14 - Authenticated (Contributor+) SQL Injection via 'pgroup' Shortcode Attribute Affected: through 5.7.14 |
| CVE-2026-118192 New | 6.5 | Oct 29 | JoomSport <= 5.7.11 - Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode Attribute Affected: through 5.7.11 |
| CVE-2026-13010 | 6.5 | Jul 10 | JoomSport <= 5.7.9 - Authenticated (Contributor+) SQL Injection via 'event' Shortcode Attribute Affected: through 5.7.9 |
| CVE-2026-11920 | 4.9 | Aug 5 | JoomSport <= 5.7.9 - Authenticated (Administrator+) SQL Injection via 'order' Parameter Affected: through 5.7.9 |
| CVE-2022-2718 | 4.9 | Sep 6 | JoomSport – for Sports: Team & League, Football, Hockey & more <= 5.2.5 - Authenticated (Admin+) SQL Injection via orderby Affected: through 5.2.5 |
| CVE-2022-2717 | 4.9 | Sep 6 | JoomSport – for Sports: Team & League, Football, Hockey & more <= 5.2.5 - Authentciated (Admin+) SQL Injection via orderby Affected: through 5.2.5 |
| CVE-2026-12134 | 4.3 | Jul 2 | JoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Creation/Modification via season_groupedit AJAX action Affected: through 5.7.8 |
| CVE-2026-12133 | 4.3 | Jul 1 | JoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Deletion via season_groupdel AJAX action Affected: through 5.7.8 |
Showing 11