Code injection

An issue was discovered in Joomla! 3.0.0 through 3.9.24. commedia allowed paths that are not intended for image uploads...

Path traversal

An issue was discovered in Joomla! 3.0.0 through 3.9.24. Extracting an specifilcy crafted zip package could write files outside of the intended path...

Code injection

An issue was discovered in Joomla! 1.6.0 through 3.9.24. Inadequate filtering of form contents could allow to overwrite the author field...

Design/Logic Flaw

An issue was discovered in Joomla! 3.0.0 through 3.9.24. Incorrect ACL checks could allow unauthorized change of the category for an article...

Cross site scripting

An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of feed fields could lead to xss issues...

CVE-2021-26028

CVE-2021-26028 affects Joomla! 3.0.0–3.9.24. A vulnerability in the core ZIP extraction path traversal allows a crafted zip file to write files outside the intended directory. Connected advisories confirm this is a path-traversal issue within the joomla/archive zip class, with public references n...

CVE-2021-26027

CVE-2021-26027 affects Joomla! 3.0.0 through 3.9.24. The issue is incorrect ACL checks that could allow unauthorized changes to an article's category in com_content frontend editing. Public sources confirm the vulnerability across the Joomla! core and relate it to broader set of issues fixed in J...

CVE-2021-26029

CVE-2021-26029 affects Joomla! 1.6.0 through 3.9.24. The issue is improper filtering of form contents that could allow an attacker to overwrite the author field in articles. Impact is author-field override with no data-exfiltration details provided in the sources. A patch/update is noted in the r...

CVE-2021-26027 [20210307] - Core - ACL violation within com_content frontend editing

An issue was discovered in Joomla! 3.0.0 through 3.9.24. Incorrect ACL checks could allow unauthorized change of the category for an article...

CVE-2021-26029 [20210309] - Core - Inadequate filtering of form contents could allow to overwrite the author field

An issue was discovered in Joomla! 1.6.0 through 3.9.24. Inadequate filtering of form contents could allow to overwrite the author field...

CVE-2021-26028 [20210308] - Core - Path Traversal within joomla/archive zip class

An issue was discovered in Joomla! 3.0.0 through 3.9.24. Extracting an specifilcy crafted zip package could write files outside of the intended path...

CVE-2021-23132 [20210306] - Core - com_media allowed paths that are not intended for image uploads

An issue was discovered in Joomla! 3.0.0 through 3.9.24. commedia allowed paths that are not intended for image uploads...

CVE-2021-23130

CVE-2021-23130 affects Joomla! 2.5.0 through 3.9.24, due to missing filtering of feed fields that could allow cross-site scripting (XSS). The vulnerability is documented across multiple feeds (NVD, OSV, OSS vulnerability trackers) with public details indicating an XSS risk via the feed parser lib...

CVE-2021-23127

CVE-2021-23127 affects Joomla! 3.2.0 through 3.9.24, where the 2FA secret generation uses an insufficient length (10 bytes instead of 20 bytes per RFC 4226). This vulnerability could impact authentication-related hashes/secrets. The connected docs indicate the issue lies in inadequate randomness/...

CVE-2021-23127 [20210301] - Core - Insecure randomness within 2FA secret generation

An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes...

CVE-2021-23132

The CVE-2021-23132 issue affects Joomla! core: versions 3.0.0 through 3.9.24 allow image-upload paths in com_media that were not intended, enabling access to unintended directories. Root cause: insecure handling in com_media leading to path exposure and potential exploitation. Documented impact i...

CVE-2021-23129 [20210303] - Core - XSS within alert messages showed to users

An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of messages showed to users that could lead to xss issues...

CVE-2021-23131 [20210305] - Core - Input validation within the template manager

An issue was discovered in Joomla! 3.2.0 through 3.9.24. Missing input validation within the template manager...

CVE-2021-23130 [20210304] - Core - XSS within the feed parser library

An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of feed fields could lead to xss issues...

CVE-2021-23131

CVE-2021-23131 affects Joomla! 3.2.0 through 3.9.24, with missing input validation in the template manager as the root cause. Exploitation details are not provided in the supplied documents; the issue is addressed in Joomla! 3.9.25 (per advisories noting fixes in that release). Connected sources ...