| Package | Affected versions | Patched versions |
|---|---|---|
| tf content | ≥ 2.9.0, ≤ 2.9.4 |
Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task `records.custom_action` without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token enforcement. A Guest can supply the numeric ID of any published TF Content task and make the component dispatch its configured executor immediately.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free