Joomla! vulnerable to Cross-site Scripting

Multiple cross-site scripting XSS vulnerabilities in Joomla! 1.6.3 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

GHSA-WWFH-28HX-W2R2 Joomla! Framework Remote Code Injection Vulnerability

The Session package 1.x before 1.3.1 for Joomla! Framework allows remote attackers to execute arbitrary code via unspecified session values...

Joomla! Framework Remote Code Injection Vulnerability

The Session package 1.x before 1.3.1 for Joomla! Framework allows remote attackers to execute arbitrary code via unspecified session values...

Joomla! Cross-site Scripting vulnerability

Cross-site scripting XSS vulnerability in libraries/idnaconvert/example.php in Joomla! 3.1.5 allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

GHSA-5XMG-W578-GQ5J Joomla! Cross-site Scripting vulnerability

Cross-site scripting XSS vulnerability in libraries/idnaconvert/example.php in Joomla! 3.1.5 allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

Joomla! XSS Vulnerability

An issue was discovered in Joomla! Core starting in 3.0.0 and prior to 3.8.8. Inadequate input filtering leads to a multiple XSS vulnerabilities. Additionally, the default filtering settings could potentially allow users of the default Administrator user group to perform a XSS attack...

GHSA-G3M5-VVJ7-XRWV Joomla! XSS Vulnerability

An issue was discovered in Joomla! Core starting in 3.0.0 and prior to 3.8.8. Inadequate input filtering leads to a multiple XSS vulnerabilities. Additionally, the default filtering settings could potentially allow users of the default Administrator user group to perform a XSS attack...

GHSA-FJ57-VHRC-73R7 Joomla! vulnerable to Cross-site Scripting

Multiple cross-site scripting XSS vulnerabilities in the back end in Joomla! 1.5 through 1.5.17 allow remote attackers to inject arbitrary web script or HTML via unknown vectors related to "various administrator screens," possibly the search parameter in administrator/index.php...

Joomla! vulnerable to Cross-site Scripting

Multiple cross-site scripting XSS vulnerabilities in the back end in Joomla! 1.5 through 1.5.17 allow remote attackers to inject arbitrary web script or HTML via unknown vectors related to "various administrator screens," possibly the search parameter in administrator/index.php...

GHSA-VCQ7-X4WR-W2MJ Joomla! vulnerable to Cross-site Scripting

Multiple cross-site scripting XSS vulnerabilities in Joomla! before 1.6.4 allow remote attackers to inject arbitrary web script or HTML via 1 the query string to the comcontact component, as demonstrated by the Itemid parameter to index.php; 2 the query string to the comcontent component, as...

Joomla! vulnerable to Cross-site Scripting

Multiple cross-site scripting XSS vulnerabilities in Joomla! before 1.6.4 allow remote attackers to inject arbitrary web script or HTML via 1 the query string to the comcontact component, as demonstrated by the Itemid parameter to index.php; 2 the query string to the comcontent component, as...

GHSA-5M3W-RVVH-8FX6 Joomla! Object Injection Vulnerability

An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for object injection attacks because there is no protection mechanism such as the TYPO3 PHAR stream wrapper to prevent use of the phar:// handler for non .phar-files...

Joomla! Object Injection Vulnerability

An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for object injection attacks because there is no protection mechanism such as the TYPO3 PHAR stream wrapper to prevent use of the phar:// handler for non .phar-files...

GHSA-9M72-PW47-292W Joomla RCE Vulnerability

An issue was discovered in Joomla! before 3.8.13. comjoomlaupdate allows the execution of arbitrary code. The default ACL config enabled the ability of Administrator-level users to access comjoomlaupdate and trigger code execution...

Joomla RCE Vulnerability

An issue was discovered in Joomla! before 3.8.13. comjoomlaupdate allows the execution of arbitrary code. The default ACL config enabled the ability of Administrator-level users to access comjoomlaupdate and trigger code execution...

Joomla SexyPolling 2.1.7 SQL Injection

Exploit Title: Joomla Plugin SexyPolling 2.1.7 - SQLi Google Dork: intext:"Powered by Sexy Polling" Date: 2022-02-08 Exploit Author: Wolfgang Hotwagner Vendor Homepage: https://2glux.com/projects/sexypolling Software Link: https://2glux.com/downloads/files/free/sexypollingpack2.1.72glux.com.zip...

Joomla Plugin SexyPolling 2.1.7 - SQLi

Exploit Title: Joomla Plugin SexyPolling 2.1.7 - SQLi Google Dork: intext:"Powered by Sexy Polling" Date: 2022-02-08 Exploit Author: Wolfgang Hotwagner Vendor Homepage: https://2glux.com/projects/sexypolling Software Link: https://2glux.com/downloads/files/free/sexypollingpack2.1.72glux.com.zip...

CVE-2022-23802

Joomla Guru extension 5.2.5 is affected by: Insecure Permissions. The impact is: obtain sensitive information remote. The component is: Access to private information and components, possibility to view other users' information. Information disclosure Access to private information and components,...

CVE-2022-27909

In Joomla component 'jDownloads 3.9.8.2 Stable' the remote user can change some parameters in the address bar and see the names of other users' files...

CVE-2022-23802

Joomla Guru extension 5.2.5 is affected by: Insecure Permissions. The impact is: obtain sensitive information remote. The component is: Access to private information and components, possibility to view other users' information. Information disclosure Access to private information and components,...