Joomla Security Vulnerabilities

CVE-2024-32788

Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG Joomla to WordPress.This issue affects FG Joomla to WordPress: from n/a through...

CVE-2024-21722

The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been...

CVE-2024-21723

Inadequate parsing of URLs could result into an open...

CVE-2024-21725

Inadequate escaping of mail addresses lead to XSS vulnerabilities in various...

CVE-2024-21724

Inadequate input validation for media selection fields lead to XSS vulnerabilities in various...

CVE-2024-21726

Inadequate content filtering leads to XSS vulnerabilities in various...

CVE-2024-24837

Cross-Site Request Forgery (CSRF) vulnerability in Frédéric GILLES FG PrestaShop to WooCommerce, Frédéric GILLES FG Drupal to WordPress, Frédéric GILLES FG Joomla to WordPress.This issue affects FG PrestaShop to WooCommerce: from n/a through 4.44.3; FG Drupal to WordPress: from n/a through 3.67.0;....

CVE-2024-21728

An Open Redirect vulnerability was found in osTicky2 below 2.2.8. osTicky (osTicket Bridge) by SmartCalc is a Joomla 3.x extension that provides Joomla fronted integration with osTicket, a popular Support ticket system. The Open Redirect vulnerability allows attackers to control the return...

CVE-2024-21727

XSS vulnerability in DP Calendar component for...

CVE-2023-49708

SQLi vulnerability in Starshop component for...

CVE-2023-49707

SQLi vulnerability in S5 Register module for...

CVE-2023-40627

A reflected XSS vulnerability was discovered in the LivingWord component for...

CVE-2023-40656

A reflected XSS vulnerability was discovered in the Quickform component for...

CVE-2023-40657

A reflected XSS vulnerability was discovered in the Joomdoc component for...

CVE-2023-40629

SQLi vulnerability in LMS Lite component for...

CVE-2023-40658

A reflected XSS vulnerability was discovered in the Clicky Analytics Dashboard module for...

CVE-2023-40628

A reflected XSS vulnerability was discovered in the Extplorer component for...

CVE-2023-40630

Unauthenticated LFI/SSRF in JCDashboards component for...

CVE-2023-40655

A reflected XSS vulnerability was discovered in the Proforms Basic component for...

CVE-2023-40659

A reflected XSS vulnerability was discovered in the Easy Quick Contact module for...

CVE-2023-40626

The language file parsing process could be manipulated to expose environment variables. Environment variables might contain sensible...

CVE-2023-39974

Exposure of Sensitive Information vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized actors to get the number of subscribers in a specific...

CVE-2023-39972

Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized users to create new mailing...

CVE-2023-39970

Unrestricted Upload of File with Dangerous Type vulnerability in AcyMailing component for Joomla. It allows remote code...

CVE-2023-39971

Improper Neutralization of Input During Web Page Generation vulnerability in AcyMailing Enterprise component for Joomla allows XSS. This issue affects AcyMailing Enterprise component for Joomla:...

CVE-2023-39973

Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows the unauthorized removal of attachments from...

CVE-2023-34476

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL...

CVE-2023-34477

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL...

CVE-2023-38044

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL...

CVE-2023-38045

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in advcomsys.com oneVote component for Joomla. It allows XSS Targeting Non-Script...

CVE-2023-23758

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL...

CVE-2023-23757

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL...

CVE-2023-23756

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in advcomsys.com oneVote component for Joomla. It allows XSS Targeting Non-Script...

CVE-2023-23754

An issue was discovered in Joomla! 4.2.0 through 4.3.1. Lack of input validation caused an open redirect and XSS issue within the new mfa selection...

CVE-2023-23755

An issue was discovered in Joomla! 4.2.0 through 4.3.1. The lack of rate limiting allowed brute force attacks against MFA...

CVE-2023-23753

The 'Visforms Base Package for Joomla 3' extension is vulnerable to SQL Injection as concatenation is used to construct an SQL Query. An attacker can interact with the database and could be able to read, modify and delete data on...

CVE-2023-28732

Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system files via path traversal, when being granted access to the campaign's creation on front-office. This issue affects AnyMailing Joomla...

CVE-2023-28731

AnyMailing Joomla Plugin is vulnerable to unauthenticated remote code execution, when being granted access to the campaign's creation on front-office due to unrestricted file upload allowing PHP code to be injected. This issue affects AnyMailing Joomla Plugin Enterprise in versions below...

CVE-2023-28733

AnyMailing Joomla Plugin is vulnerable to stored cross site scripting (XSS) in templates and emails of AcyMailing, exploitable without authentication when access is granted to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plugin Enterprise in versions below...

CVE-2023-23752

An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice...

CVE-2023-23750

An issue was discovered in Joomla! 4.0.0 through 4.2.6. A missing token check causes a CSRF vulnerability in the handling of post-installation...

CVE-2023-23751

An issue was discovered in Joomla! 4.0.0 through 4.2.4. A missing ACL check allows non super-admin users to access...

CVE-2022-27914

An issue was discovered in Joomla! 4.0.0 through 4.2.4. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in...

CVE-2022-27913

An issue was discovered in Joomla! 4.2.0 through 4.2.3. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in various...

CVE-2022-27912

An issue was discovered in Joomla! 4.0.0 through 4.2.3. Sites with publicly enabled debug mode exposed data of previous...

CVE-2022-27911

An issue was discovered in Joomla! 4.2.0. Multiple Full Path Disclosures because of missing '_JEXEC or die check' caused by the PSR12...

CVE-2022-23795

An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bound to a specific authentication mechanism which could under very special circumstances allow an account...

CVE-2022-23801

An issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedding in...

CVE-2022-23800

An issue was discovered in Joomla! 4.0.0 through 4.1.0. Inadequate content filtering leads to XSS vulnerabilities in various...

CVE-2022-23796

An issue was discovered in Joomla! 3.7.0 through 3.10.6. Lack of input validation could allow an XSS attack using...