BE
Vendor
beardev
16
CVEs
0
On KEV
1
New 30D
Products
JF9.8
JoomSport – for Sports: Team & League, Football, Hockey & more
beardev
8 CVEs0 on KEV1 new
JO9.8
JoomSport
beardev
8 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-118192 New | JF JoomSport – for Sports: Team & League, Football, Hockey & more beardev | 6.5 | Oct 29 | JoomSport <= 5.7.11 - Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode Attribute |
| CVE-2026-11920 | JF JoomSport – for Sports: Team & League, Football, Hockey & more beardev | 4.9 | Aug 5 | JoomSport <= 5.7.9 - Authenticated (Administrator+) SQL Injection via 'order' Parameter |
| CVE-2026-13010 | JF JoomSport – for Sports: Team & League, Football, Hockey & more beardev | 6.5 | Jul 10 | JoomSport <= 5.7.9 - Authenticated (Contributor+) SQL Injection via 'event' Shortcode Attribute |
| CVE-2026-12134 | JF JoomSport – for Sports: Team & League, Football, Hockey & more beardev | 4.3 | Jul 2 | JoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Creation/Modification via season_groupedit AJAX action |
| CVE-2026-12133 | JF JoomSport – for Sports: Team & League, Football, Hockey & more beardev | 4.3 | Jul 1 | JoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Deletion via season_groupdel AJAX action |
| CVE-2026-42647 | JO JoomSport Beardev | 9.3 | Jun 11 | WordPress JoomSport plugin <= 5.7.7 - SQL Injection vulnerability |
| CVE-2026-6929 | JF JoomSport – for Sports: Team & League, Football, Hockey & more beardev | 7.5 | May 13 | JoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' Parameter |
| CVE-2025-7721 | JF JoomSport – for Sports: Team & League, Football, Hockey & more beardev | 9.8 | Oct 3 | JoomSport <= 5.7.3 - Unauthenticated Directory Traversal to Local File Inclusion |
| CVE-2024-12633 | JF JoomSport – for Sports: Team & League, Football, Hockey & more beardev | 7.1 | Jan 7 | JoomSport <= 5.6.17 - Reflected Cross-Site Scripting via page |
| CVE-2024-43355 | JO JoomSport BearDev | 8.8 | Nov 1 | WordPress JoomSport plugin <= 5.3.0 - Broken Access Control vulnerability |
| CVE-2024-44031 | JO JoomSport beardev | 8.8 | Nov 1 | WordPress JoomSport plugin <= 5.6.3 - Broken Access Control vulnerability |
| CVE-2022-4050 | JO Joomsport Beardev | 9.8 | Dec 19 | The JoomSport WordPress plugin before 5.2.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by… |
| CVE-2022-2718 | JO Joomsport Beardev | 4.9 | Sep 6 | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter on the… |
| CVE-2022-2717 | JO Joomsport Beardev | 4.9 | Sep 6 | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter on the joomsport-events-form… |
| CVE-2021-24384 | JO Joomsport Beardev | 9.8 | Jul 6 | The joomsport_md_load AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated and unauthenticated users, unserialised user input from the… |
| CVE-2019-14348 | JO Joomsport Beardev | 9.8 | Aug 5 | The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport_season/new-yorkers/?action=playerlist sid… |