Code injection

An issue was discovered in Joomla! before 3.9.7. The update server URL of comjoomlaupdate can be manipulated by non Super-Admin users...

Input validation

An issue was discovered in Joomla! before 3.9.7. The CSV export of comactionslogs is vulnerable to CSV injection...

CVE-2019-12764

An issue was discovered in Joomla! before 3.9.7. The update server URL of comjoomlaupdate can be manipulated by non Super-Admin users...

CVE-2019-12766

An issue was discovered in Joomla! before 3.9.7. The subform fieldtype does not sufficiently filter or validate input of subfields. This leads to XSS attack vectors...

CVE-2019-12766

CVE-2019-12766 relates to Joomla! before 3.9.7, where the subform fieldtype fails to filter/validate input in subfields, enabling cross-site scripting (XSS) vectors. The issue is documented across multiple sources referencing Joomla! core before 3.9.7 and specifically the subform input validation...

CVE-2019-12765

An issue was discovered in Joomla! before 3.9.7. The CSV export of comactionslogs is vulnerable to CSV injection...

CVE-2019-12765

CVE-2019-12765 affects Joomla! prior to 3.9.7. The issue is a CSV injection in the CSV export of the com_actionslogs component, caused by insufficient input validation during export. Public references (NVD/NIST, Nessus, OSV, CNVD, ENISA) confirm the vulnerability in Joomla! versions 3.9.0–3.9.6 (...

EUVD-2019-4349

An issue was discovered in Joomla! before 3.9.7. The CSV export of comactionslogs is vulnerable to CSV injection...

CVE-2019-12764

An issue was discovered in Joomla! before 3.9.7. The update server URL of comjoomlaupdate can be manipulated by non Super-Admin users...

CVE-2019-12764

CVE-2019-12764 affects Joomla! prior to 3.9.7. The vulnerability is in the update server URL for component com_joomlaupdate, which can be manipulated by non Super-Admin users. Documented impact indicates potential integrity/confidentiality risk via update source redirection, but explicit exploita...

PT-2019-12932 · Open Source Matters · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions prior to 3.9.7 Description: An issue was discovered in the CSV export of com actionslogs, which is vulnerable to CSV injection. Recommendations: For versions prior to 3.9.7, update to version 3.9.7 or later to resolve the iss...

PT-2019-12931 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions prior to 3.9.7 Description: An issue was discovered where the update server URL of com joomlaupdate can be manipulated by non Super-Admin users. Recommendations: For versions prior to 3.9.7, update to version 3.9.7 or later t...

PT-2019-12933 · Open Source Matters · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions prior to 3.9.7 Description: An issue was discovered where the subform fieldtype does not sufficiently filter or validate input of subfields, leading to XSS attack vectors. Recommendations: For versions prior to 3.9.7, update ...

SQL Injection Vulnerability in Joomla! AppsConda Component ap***.php Page

Joomla! is an open source content management system CMS, the system provides RSS feeds, site search and other functions. A SQL injection vulnerability exists in the ap.php page of the Joomla! AppsConda component. An attacker can exploit the vulnerability to obtain sensitive database information...

SQL Injection Vulnerability in Joomla! AppsConda Component ap***.php Page

Joomla! is an open source content management system CMS, the system provides RSS feeds, site search and other functions. A SQL injection vulnerability exists in the ap.php page of the Joomla! AppsConda component. An attacker can exploit the vulnerability to obtain sensitive database information...

SQL Injection Vulnerability in Joomla! AppsConda Component no***.php Page

Joomla! is an open source content management system CMS, the system provides RSS feeds, site search and other functions. A SQL injection vulnerability exists in the Joomla! AppsConda component no.php page. An attacker can exploit the vulnerability to obtain sensitive database information...

SQL Injection Vulnerability in AMGallery Component of Joomla!

Joomla! is an open source content management system, the system provides RSS feeds, site search and other functions. A SQL injection vulnerability exists in the AMGallery component of Joomla! An attacker can exploit the vulnerability to obtain sensitive database information...

Joomla! < 3.9.6 Phar Stream Wrapper Vulnerability

Joomla! is prone to a protection bypass vulnerability of the Phar Stream Wrapper Interceptor. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only C...

Joomla! < 3.9.6 XSS Vulnerability

This VT has been deprecated due to the CVE already being covered by another script SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Joomla! 1.7.x < 3.9.6 Multiple Vulnerabilities

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities : - A protection bypass exists in versions 3.9.3 to 3.9.5 within the Phar Stream Wrapper Interceptor due to path traversal - A cross-site scripting XSS vulnerability exists in...