Recent posts

Thanks for the reply.

I can confirm the security issue I reported privately is still present in the latest release, 4.8.2 (build 11343) — it is not fixed there.

I won't post any specifics here, since this is a public thread and the issue is serious. I have the full details, a proof of concept and supporting evidence ready to share privately.

Before I send them, I need to be sure I'm sending to an actual member of the core development team. Could you confirm your affiliation in whatever way you consider appropriate? Once I can verify it, I'll send everything straight away.

Thanks for handling this responsibly.

#25

Security (https) / Performance / SEO, SEF, URLs / Re: Critical unauthenticated R...

Last post by Ghost - September 10, 2026, 10:29:43 AM

Is this issue still present in 4.8.2.11343? And have you tried contacting on "Discord" (https://forum.virtuemart.net/index.php?board=142.0)? It's the main communication platform for VM development now.

#26

Security (https) / Performance / SEO, SEF, URLs / Re: Critical unauthenticated R...

Last post by sirius - September 09, 2026, 22:35:06 PM

Hi the 4.6.4 is very old now
https://virtuemart.net/news/list-all-blogs
you should go for 4.8

You can pm me if you want

#27

3rd party extension / Re: Responsive Joomla 5 and J...

Last post by sirius - September 09, 2026, 22:31:53 PM

Hi Jumbo, I successfully installed the template update; I just did it after updating VirtueMart, which is why I was asking. That said, everything is fine—zero errors.

#28

Security (https) / Performance / SEO, SEF, URLs / Re: Critical unauthenticated R...

Last post by d0ublezer0 - September 09, 2026, 22:16:46 PM

Anyone? Guys, there's a serious security issue that could allow anyone to hack a site running VM—it happened to me. Who on the dev team can I contact? Milbo isn't replying, and I don't know anyone else who's actually part of the team. Also, I think I picked the wrong forum section to ask this.

#29

Security (https) / Performance / SEO, SEF, URLs / Critical unauthenticated RCE i...

Last post by d0ublezer0 - September 08, 2026, 21:32:07 PM

Hi everyone,

I found a critical, unauthenticated remote code execution vulnerability in VirtueMart core — confirmed present in the current release (4.6.4 "Eagle owl"), affecting every up-to-date VirtueMart installation, not just outdated ones. A single unauthenticated GET request is enough, no login, no CSRF token.

I reported this privately to Milbo in late August specifically to avoid publishing a working exploit before a fix ships. It's now been over a week with no response.

Given the severity — this is being actively exploited in the wild, we lost a production site to it — I don't think it's responsible to keep sitting on it silently while waiting indefinitely. I'd like to escalate this to the VirtueMart core team directly rather than post exploit details here.

Could someone from the core team reach out so I can share the full technical write-up, proof of concept, and a suggested fix directly? I'm still not looking to go public with the details — just need this in front of someone who can act on it.

Thanks

#30

Virtuemart Development and bug reports / Re: After update to 4.8.2 cann...

Last post by piliop - September 07, 2026, 15:22:53 PM

in administrator\components\com_virtuemart\models\media.php

under the line 405 that seems like this :

Code Select

if(!is_array($oldIds)) $oldIds = array($oldIds);

Add

Code Select

if(isset($data['ordering'], $data['active_media_id'])){
            if(!isset($data['mediaordering']) || !is_array($data['mediaordering'])){
                $data['mediaordering'] = array();
            }
            $data['mediaordering'][(int)$data['active_media_id']] = (int)$data['ordering'];
        }

also

after line 440 whitch seems like this :

Code Select

// Bind the media to the product,

replace the line

Code Select

return $table->bindChecknStore($data);
With

Code Select

$result = $table->bindChecknStore($data);

        if(!empty($data['mediaordering']) && !empty($data['virtuemart_'.$type.'_id'])){
            $db = JFactory::getDbo();
            $relationTable = '#__virtuemart_'.$type.'_medias';
            $entityId = (int)$data['virtuemart_'.$type.'_id'];
            foreach($data['mediaordering'] as $mediaId => $ordering){
                $query = $db->getQuery(true)
                    ->update($db->quoteName($relationTable))
                    ->set($db->quoteName('ordering').' = '.(int)$ordering)
                    ->where($db->quoteName('virtuemart_'.$type.'_id').' = '.$entityId)
                    ->where($db->quoteName('virtuemart_media_id').' = '.(int)$mediaId);
                $db->setQuery($query)->execute();
            }
        }

        return $result;

Pages 1 2 3 4 5 ... 10