EIP-2026-108853

PRE-CVE

Joomla! Component SecurityCheck 2.8.9 - Multiple Vulnerabilities

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-108853. PoCs published by ADEO Security.

AI-analyzed exploit summary This exploit demonstrates SQL injection and stored XSS vulnerabilities in Joomla's SecurityCheck extension. The SQLi allows extraction of database information and admin session IDs, while the XSS can silently add a new admin user.

Description

Joomla! Component SecurityCheck 2.8.9 - Multiple Vulnerabilities

Exploits (1)

exploitdb WORKING POC VERIFIED

by ADEO Security · textwebappsphp

https://www.exploit-db.com/exploits/39879

View Code ZIP pw:eip

This exploit demonstrates SQL injection and stored XSS vulnerabilities in Joomla's SecurityCheck extension. The SQLi allows extraction of database information and admin session IDs, while the XSS can silently add a new admin user.

Classification

Working Poc 90%

Attack Type

Sqli | Xss

Complexity

Trivial

Reliability

Reliable

Target: Joomla SecurityCheck and SecurityCheck Pro <= 2.8.9

No auth needed

Prerequisites: Access to the target Joomla instance

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026