CVE-2026-97160

CVE-2026-97160

Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

Vulnerability class: RCE (Remote Code Execution)

Published 2026-09-26 · last modified 2026-09-26.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Weakness classification (CWE)

CWE-94 — Code Injection

Public proof-of-concept exploits

murrez/CVE-2026-97160

References

up.lomart.fr/ (product)

Frequently asked questions

What is CVE-2026-97160?: CVE-2026-97160 is a vulnerability, classified under Code Injection. Published 2026-09-26.
Is CVE-2026-97160 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.