CVE-2026-75953
UnknownSummary
The Joomla extension J-BusinessDirectory versions below 6.2.3 contain an open mail relay. The recipient address is taken from the request (contact_id_offer / contact_id_event parameters) instead of the server-side offer/event record, allowing mail to be sent to an arbitrary address.
Risk Assessment
An attacker can exploit this vulnerability to send spam or phishing emails from the server, potentially damaging the organization's reputation and causing email deliverability issues.
Recommendation
Update the J-BusinessDirectory extension to version 6.2.3 or later, which includes a fix for the open relay.
Original NVD description (English source)
Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3 - Recipient address was taken from the request (contact_id_offer / contact_id_event) instead of the server-side offer/event record, so mail could be sent to an arbitrary address.