# CVE-2026-105604: Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3

- Exploited (CISA KEV): no
- Published: 2026-11-02
- CVSS: 9.3 CRITICAL (v4.0)
- EPSS: no score
- CWE: CWE-89

Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated SQL injection vector in the frontend search.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | No public claim | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

## Social

4 posts seen since 2026-11-02.

- x 2026-11-02: 🆕 New CVE: CVE-2026-105604 (CVSS 9.3) https://t.co/cAu22IedE0 DJ-Classifieds extension for Joomla · SQL injection Remote, no login needed.  Joomla Extension - https://t.co/cAu22IedE0 - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 - The Joomla extension… (https://x.com/EnclaveRadar/status/2117397759812644905)
- bluesky 2026-11-02: CVE-2026-105604 - dj-classifieds extension for joomla The DJ-Classifieds add‑on for Joomla lets anyone on the public website send specially crafted search requests that cause the site’s database to run unexpected commands.…  Too many irrelevant or confusing CVEs? Use stackflag.c… (https://bsky.app/profile/stackflag.bsky.social/post/3mze5jivpq72n)
- bluesky 2026-11-02: 🚨 CVE-2026-105604 — CVSS 9.3 CRITICAL  Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 - The Jooml...  🔎 https://stemshop.top/cve/CVE-2026-105604  #CVE #CyberSecurity #InfoSec (https://bsky.app/profile/stemshop.bsky.social/post/3mze4trvzpc25)
- bluesky 2026-11-02: CVE-2026-105604 - Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds CVE ID : CVE-2026-105604    Published : Nov. 2, 2026, 6:27 p.m. \| 37 minutes ago    Description : Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ... (https://bsky.app/profile/cve.skyfleet.blue/post/d3sdk634bfk5k)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-105604 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-105604