CVE-2021-26039

CVE-2021-26039 affects Joomla! 3.0.0 through 3.9.27. The issue is an inadequate escaping in the imagelist view of the com_media component, causing a Cross-Site Scripting (XSS) vulnerability. This is consistently reported across NVD, OSV, and related feeds, with no exploit details provided in the ...

CVE-2021-26037 [20210703] - Core - Lack of enforced session termination

An issue was discovered in Joomla! 2.5.0 through 3.9.27. CMS functions did not properly termine existing user sessions when a user's password was changed or the user was blocked...

CVE-2021-26038 [20210704] - Core - Privilege escalation through com_installer

An issue was discovered in Joomla! 2.5.0 through 3.9.27. Install action in cominstaller lack the required hardcoded ACL checks for superusers. A default system is not affected cause the default ACL for cominstaller is limited to super users already...

CVE-2021-26038

Joomla! 2.5.0 through 3.9.27 is affected by CVE-2021-26038 due to an install action in com_installer lacking hardcoded ACL checks for superusers, enabling privilege escalation. The default ACL for com_installer is limited to super users, so the default system is not affected. A patch is available...

CVE-2021-26037

CVE-2021-26037 affects Joomla! core versions 2.5.0 through 3.9.27. The root cause is that CMS functions did not properly terminate existing user sessions when a user’s password was changed or the user was blocked. This behavioral gap can allow an attacker to retain or regain a session that should...

CVE-2021-26036 [20210702] - Core - DoS through usergroup table manipulation

An issue was discovered in Joomla! 2.5.0 through 3.9.27. Missing validation of input could lead to a broken usergroups table...

CVE-2021-26036

CVE-2021-26036 affects Joomla! 2.5.0 through 3.9.27 due to missing input validation that can corrupt the usergroups table. Impact is described as a DoS via manipulation of usergroup data, with CVSS scores indicating NETWORK attack, low complexity, and availability impact HIGH in CVSS v3.1 (base 7...

CVE-2021-26035 [20210701] - Core - XSS in JForm Rules field

An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the rules field of the JForm API leads to a XSS vulnerability...

CVE-2021-26035

CVE-2021-26035 affects Joomla! 3.0.0–3.9.27, due to inadequate escaping in the JForm API rules field, enabling Cross‑Site Scripting (XSS). The issue is documented with CVSS v3.1 base score 6.1 (MEDIUM) and CVSS v2 base score 4.3 (MEDIUM). Nessus and other sources corroborate the XSS vulnerability...

PT-2021-16928 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.0.0 through 3.9.27 Description: An issue was discovered in the JForm API, where inadequate escaping in the rules field leads to a XSS vulnerability. Recommendations: For versions 3.0.0 through 3.9.27, update to a version th...

Vulnerabilities fixed in Joomla!

Vulnerabilities have been fixed in Joomla! The vulnerabilities allow a malicious person to launch attacks that lead to the following categories of damage: Cross-Site Scripting XSS Denial-of-Service DoS. Circumvention of security measure. Remote code execution User rights released updates to addre...

PT-2021-16929 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 2.5.0 through 3.9.27 Description: An issue was discovered in Joomla! where missing validation of input could lead to a broken usergroups table. Recommendations: For Joomla! versions 2.5.0 through 3.9.27, update to a version...

PT-2021-16930 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 2.5.0 through 3.9.27 Description: An issue was discovered in the CMS functions where existing user sessions were not properly terminated when a user's password was changed or the user was blocked. Recommendations: For Joomla!...

Joomla! 跨站脚本漏洞

A cross-site scripting vulnerability exists in versions 3.0.0 to 3.9.27, which could be exploited to lure users into clicking on and executing client-side code to steal user cookie credentials...

Code problem vulnerability of Joomla!

Joomla! is a set of forum components used in the Joomla! content management system. A code issue vulnerability exists in Joomla! 2.5.0 - 3.9.27. The vulnerability stems from a hard-coded ACL check for superuser missing from the install operation in cominstaller, which can be exploited to execute...

Joomla! 代码问题漏洞

Joomla! is a set of forum components used in the Joomla! content management system. A code issue vulnerability exists in Joomla! 2.5.0 - 3.9.27. The vulnerability stems from a hard-coded ACL check for superuser missing from the install operation in cominstaller, which can be exploited to execute...

Joomla! input validation error vulnerability (CNVD-2021-53939)

is a set of forum components used in the Joomla! content management system. Joomla! is vulnerable to an input validation error in versions 2.5.0 to 3.9.27, which can be exploited by attackers to cause corruption in the usergroups table...

Joomla! CMS 输入验证错误漏洞

is a set of forum components used in the Joomla! content management system. Joomla! is vulnerable to an input validation error in versions 2.5.0 to 3.9.27, which can be exploited by attackers to cause corruption in the usergroups table...

PT-2021-16931 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 2.5.0 through 3.9.27 Description: An issue was discovered in the install action of com installer, where it lacks the required hardcoded ACL checks for superusers. However, a default system is not affected because the default...

PT-2021-16932 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.0.0 through 3.9.27 Description: An issue was discovered in the imagelist view of com media, where inadequate escaping leads to a XSS vulnerability. Recommendations: For versions 3.0.0 through 3.9.27, update to a version tha...