19345 matches found
CVE-2019-19845
CVE-2019-19845 affects Joomla! prior to 3.9.14. The root cause is a missing access check in framework files, which can lead to a path disclosure. This vulnerability is documented across multiple sources (e.g., Red Hat, Nessus/Nessus plugin 98936, CVE databases) and is specifically tied to Joomla!...
Joomla! SQL Injection Vulnerability (CNVD-2020-12711)
Joomla! is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source , cross-platform content management system CMS. A SQL injection vulnerability exists in Joomla! versions prior to 3.9.14, which stems from a lack of validation of externally-entered SQL statements...
Joomla 2.5.x < 3.9.14 Multiple Vulnerabilities (5781-joomla-3-9-14)
According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.9.14. It is, therefore, affected by multiple vulnerabilities. - Missing access check in framework files could lead to a path disclosure. CVE-2019-19845 - The lack of validation of...
Path Traversal Vulnerability in Joomla!
Joomla! is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source , cross-platform content management system CMS. A path traversal vulnerability exists in versions of Joomla! prior to 3.9.14, which can be exploited by an attacker to disclose paths...
CVE-2019-19634
class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576...
CVE-2019-19634
class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576...
CVE-2019-19634
class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576...
CVE-2019-19634
CVE-2019-19634 affects verot.net class.upload.php up to version 2.0.4 (and 1.0.3 in some builds) used in Joomla! K2 extension; it omits .pht from dangerous extensions, enabling arbitrary file upload and remote code execution. An exploit/POC demonstrates obtaining a shell via a crafted image uploa...
PT-2019-15893
Name of the Vulnerable Software and Affected Versions class.upload.php versions 1.0.0 through 1.0.3 class.upload.php versions 2.0.0 through 2.0.4 Description The issue is related to the omission of .pht from the set of dangerous file extensions in class.upload.php, which is similar to a previousl...
CVE-2019-19576
class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions...
CVE-2019-19576
class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions...
Code injection
class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions...
CVE-2019-19576
class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions...
CVE-2013-6878
Cross-site scripting XSS vulnerability in the Mijosoft MijoSearch component 2.0.4 and earlier for Joomla! allows remote attackers to inject arbitrary web script or HTML via the query parameter to component/mijosearch/search...
CVE-2013-6879
The Mijosoft MijoSearch component 2.0.1 and earlier for Joomla! allows remote attackers to obtain sensitive information via a request to component/mijosearch/search, which reveals the installation path in an error message...
Cross site scripting
Cross-site scripting XSS vulnerability in the Mijosoft MijoSearch component 2.0.4 and earlier for Joomla! allows remote attackers to inject arbitrary web script or HTML via the query parameter to component/mijosearch/search...
Design/Logic Flaw
The Mijosoft MijoSearch component 2.0.1 and earlier for Joomla! allows remote attackers to obtain sensitive information via a request to component/mijosearch/search, which reveals the installation path in an error message...
CVE-2013-6878
The CVE-2013-6878 entry concerns MijoSearch Joomla extension (versions 2.0.4 and earlier). The connected HTB advisory documents two vulnerabilities in MijoSearch: (1) CVE-2013-6878, a Cross-Site Scripting (XSS) flaw caused by insufficient sanitisation of user-supplied data appended to "/component...
CVE-2013-6878
Cross-site scripting XSS vulnerability in the Mijosoft MijoSearch component 2.0.4 and earlier for Joomla! allows remote attackers to inject arbitrary web script or HTML via the query parameter to component/mijosearch/search...
CVE-2013-6879
The Mijosoft MijoSearch component 2.0.1 and earlier for Joomla! allows remote attackers to obtain sensitive information via a request to component/mijosearch/search, which reveals the installation path in an error message...