Joomlatools DOCman 跨站脚本漏洞

Joomlatools DOCman is Joomlatools' Documentation and Download Manager extension for Joomla! A security vulnerability exists in Joomlatools DOCman 3.5.13, which originates from cross-site scripting in the image upload feature...

Joomla Plugin SexyPolling 2.1.7 - SQLi

Exploit Title: Joomla Plugin SexyPolling 2.1.7 - SQLi Google Dork: intext:"Powered by Sexy Polling" Date: 2022-02-08 Exploit Author: Wolfgang Hotwagner Vendor Homepage: https://2glux.com/projects/sexypolling Software Link: https://2glux.com/downloads/files/free/sexypollingpack2.1.72glux.com.zip...

jDownloads 安全漏洞

jDownloads is a Joomla! extension for jDownloads to manage downloads. A security vulnerability exists in jDownloads version 3.9.8.2. An attacker can exploit the vulnerability to change some parameters in the address bar and view the names of other users' files...

iJoomla Guru 安全漏洞

Guru is a Joomla! extension for iJoomla for creating online courses, universities or schools. A security vulnerability exists in iJoomla Guru version 5.2.5. An attacker exploited the vulnerability to remotely obtain sensitive information...

Joomla Sexy Polling 2.1.7 SQL Injection Vulnerability

SexyPolling SQL Injection ==================== | Target: | Sexy Polling Joomla Extension | | Vendor: | 2glux | | Version: | all versions below version 2.1.8 | | CVE: | Not yet | | Accessibility: | Remote | | Severity: | Critical | | Author: | Wolfgang Hotwagner AIT Austrian Institute of Technolog...

Joomla Sexy Polling 2.1.7 SQL Injection

SexyPolling SQL Injection ==================== | Identifier: | AIT-SA-20220208-01| | Target: | Sexy Polling Joomla Extension | | Vendor: | 2glux | | Version: | all versions below version 2.1.8 | | CVE: | Not yet | | Accessibility: | Remote | | Severity: | Critical | | Author: | Wolfgang Hotwagner...

VulnCheck KEV: CVE-2017-5215

The Codextrous B2J Contact aka b2jcontact extension before 2.1.13 for Joomla! allows a rename attack that bypasses a "safe file extension" protection mechanism, leading to remote code execution...

SIGE 3.4.1 / 3.5.3 Pro Cross Site Scripting / Remote File Inclusion

Document Title: =============== SIGE Joomla 3.4.1 & 3.5.3 Pro - Multiple Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2265 Release Date: ============= 2020-11-11 Vulnerability Laboratory ID VL-ID: ====================================...

Joomla SIGE 3.4.1-FREE / 3.5.3-PRO RFI / Cross Site Scripting

Title: SIGE - Simple Image Gallery Extended joomla extension 3.4.1-FREE / 3.5.3-PRO - Multi Vulnerability Remote File Inclusion RFI & Cross Site Scripting XSS date: 2020-11-11 Vendor Homepage: https://kubik-rubik.de/ Software Link: https://kubik-rubik.de/sige-simple-image-gallery-extended Softwar...

CVE-2020-22274

JomSocial Joomla Social Network Extention 4.7.6 allows CSV injection via a customer's profile...

CVE-2020-25751

The paGO Commerce plugin 2.5.9.0 for Joomla! allows SQL Injection via the administrator/index.php?option=compago&view=comments filterpublished parameter...

CVE-2020-13424

The XCloner component before 3.5.4 for Joomla! allows Authenticated Local File Disclosure...

Creative Contact Form extension path traversal vulnerability

Creative Contact Form is a responsive jQuery contact form for Joomla! A path traversal vulnerability exists in the helpers/mailer.php file in the Creative Contact Form extension version 4.6.2 for Joomla! prior to 2019-12-03. The vulnerability stems from a failure of a networked system or product ...

CVE-2020-9364

An issue was discovered in helpers/mailer.php in the Creative Contact Form extension 4.6.2 before 2019-12-03 for Joomla!. A directory traversal vulnerability resides in the filename field for uploaded attachments via the creativecontactformupload parameter. An attacker could exploit this...

CVE-2020-5182

The J-BusinessDirectory extension before 5.2.9 for Joomla! allows Reverse Tabnabbing. In some configurations, the link to the business website can be entered by any user. If it doesn't contain rel="noopener" or similar attributes such as noreferrer, the tabnabbing may occur. To reproduce the bug,...

CVE-2019-17527

dataForDepandantField in models/custormfields.php in the JS JOBS FREE extension before 1.2.7 for Joomla! allows SQL Injection via the index.php?option=comjsjobs&task=customfields.getfieldtitlebyfieldandfieldfo child parameter...

Shack Forms Pro extension path traversal vulnerability in Joomla!

Joomla! is the U.S. Open Source Matters team using PHP and MySQL development of a set of open source, cross-platform content management system CMS. Shack Forms Pro extension is used in one of the form creation plugin . A path traversal vulnerability exists in the Shack Forms Pro extension for...

CVE-2019-17399

The Shack Forms Pro extension before 4.0.32 for Joomla! allows path traversal via a file attachment...

CVE-2018-17399

SQL Injection exists in the Jimtawl 2.2.7 component for Joomla! via the id parameter...

Joomla WebMapPlus 1.0 SQL Injection

Exploit Title : Joomla WebMapPlus Components 1.0 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 04/02/2019 Vendor Homepage : artio.net Software Download Link : github.com/bkulyk/webmapplus.git Software Information Link : github.com/bkulyk/webmappl...