PatchTheCVE: uphttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2026-97163: Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.https://patchthecve.com/cve/CVE-2026-97163.htmlhttps://patchthecve.com/cve/CVE-2026-97163.htmlTue, 20 Oct 2026 20:09:45 +0000CRITICAL 9.8: Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29CVE-2026-97162: Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29https://patchthecve.com/cve/CVE-2026-97162.htmlhttps://patchthecve.com/cve/CVE-2026-97162.htmlTue, 20 Oct 2026 20:15:31 +0000CRITICAL 9.8: Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29CVE-2026-97161: Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0https://patchthecve.com/cve/CVE-2026-97161.htmlhttps://patchthecve.com/cve/CVE-2026-97161.htmlTue, 20 Oct 2026 20:17:48 +0000HIGH 7.5: Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29CVE-2026-97160: Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.https://patchthecve.com/cve/CVE-2026-97160.htmlhttps://patchthecve.com/cve/CVE-2026-97160.htmlTue, 20 Oct 2026 20:19:49 +0000HIGH 8.8: Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29